The mentions of Fuchsia by Brad Spengler, the security person in question, came after his firm Open Source Security had launched a presentation "10 Years of Linux Security – A Report Card". It also came on the day that French firm Quarks Lab examined Fuchsia and decided to put up a blog post after opting to take "a quick look at Fuchsia, learn about its inner design, security properties, strengths and weaknesses, and find ways to attack it".
Spengler's comments can be seen in perspective, once one is aware that his company creates a patch known as Grsecurity to fix security vulnerabilities in the Linux kernel. Spengler's efforts have not always been welcomed by Linux creator Linus Torvalds who at one stage called his patch a bunch of garbage.
"...with Google's investment in Linux primarily tied to Android, hopefully the other companies involved are thinking long-term about what a Linux without Google will look like when Fuchsia takes off," Spengler tweeted on Friday.
A recording of today's presentation of "10 Years of Linux Security - A Report Card" is now available to view here: https://t.co/KrnJX54Hzw PDF: https://t.co/uPmUgTrgCh PPT: https://t.co/A7P0Q2phhP pic.twitter.com/8SkcZ72czf— Open Source Security Inc. (@opensrcsec) July 2, 2020
When someone responded, saying that, "If Linux falls over because Google pulls out due to Fuchsia, we can switch over to one of the BSDs. I don't think it's gonna happen though", Spengler came back with: "Linux won't go away and Google won't pull out fully (I expect it to still be there for the server market), but as it stands, resources are already strained, so even a 25% reduction would have a huge impact. For mobile use, there's a clear transition path too."
When yet another user commented, "We still use Linux internally for Borg, and I don't think there are plans to replace that. Android is much less relevant than the internal infrastructure", Spengler responded: "Yes, I don't expect it to change related to server use, but Fuchsia in the phone/embedded market is very attractive given the limited use cases/requirements and control of the userland stack. See my other comments in the replies re: my comment being about the focus of sec effort."
Finally, to a comment that said, "there’s also docker and kubernetes. they will need to maintain linux to have containers (for now at least?)," Spengler had this response: "Yes, aware of that. There are certain devs I can think of that will stick around, but I'm thinking specifically of their security efforts (should have specified that). Contributions there (and what they blog about) have a clear focus on Android."
Fuchsia was announced almost four years ago, due to what has been interpreted as a bid to move away from Android, a system that, while enabling Google to gain market leadership, has given it a fair share of legal and other headaches.
Google developed Android in something of a hurry and it emerged on the market in 2008 in the HTC Dream, the first smartphone to run the system. The company cut many corners to speed up development as it feared that it would not be unable to gain a foothold in the market if it tried to build the operating system components all on its own. Apple had already gone to market with its first iPhone in 2007.
Google was unable to cut a deal with Sun Microsystems to license Java, so it did a little "borrowing", something that landed it in court in 2010. The case is still being litigated and it looks very much like Google will end up paying Oracle a large sum in royalties.
Switching to Fuchsia will avoid having to fork out money, something Google hates more than anything else. The company is somewhat parsimonious in its approach to business, despite salting away billions in profits every year.
The one reason why Google does not like Android is because it uses the Linux kernel. This is a bugbear because it is released under version 2 of the GNU General Public Licence, which means that any changes made to its code have to be released in the event that the kernel in question is distributed. With other bits of Android, it is all open slather; they are under licences which allow anyone to use the code and lock away the modified version.
Google great devotion to open source, but it is clear that the company likes only licences which do not specify sharing. It makes its money by licensing proprietary apps: Gmail, YouTube, Maps, Drive, Duo, Photos and the new YTMusic. Fuchsia would be a more comfortable fit for the company.
Quarks Labs looked at the design of Fuchsia, the process isolation, handles, namespaces, syscalls, mitigations and security practices. It also outlined ways of attacking the system.
The Quarks researchers noted: "All the bugs we found were reported to Google, and are now fixed. Again, it is not clear where Fuchsia is heading, and whether it is just a research OS as Google claims or a real OS that is vowed to be used on future products. What's clear, though, is that it has the potential to significantly increase the difficulty for attackers to compromise devices."
Spengler's speculation may have been due to his natural animosity to Torvalds. Many people are jealous of the success the Finn's project has achieved. And Torvalds, not being a diplomat, has made his fair share of enemies. Given all these factors, it will be interesting to see the path that Fuchsia takes.