Theo de Raadt: "You've been smoking something mind altering" (2007)

📧 Correspondence Metadata

---

💬 The Exchange

The conversation began with a claim from a user named MARC:

"Virtualization seems to have a lot of security benefits."

Theo de Raadt's response was immediate and caustic:

"You've been smoking something really mind altering, and I think you should share it."

---

🛠️ The Technical Critique

Theo argues that the perceived security of x86 virtualization is a fallacy. He breaks down the architecture as follows:

1. The Base: A "nasty" x86 architecture that struggles with basic page protection.
2. The Addition: A virtualization layer—essentially another nearly complete kernel—which is inevitably riddled with new bugs.
3. The Result: Your actual operating system is now running atop this secure "brand new pile of shit."

📉 The Logic of Vulnerability

Theo posits that the probability of a secure system is inversely proportional to the complexity added by flawed human engineers:

$\text{Security} \approx \frac{1}{\text{Complexity} \times \text{Human Error}}$

---

🚩 The Reality Check

Theo highlights the cognitive dissonance of believing that software engineers—who consistently fail to write basic applications or OSs without vulnerabilities—could suddenly produce a flawless virtualization layer.

The "Consumer" Mindset:

• Analyze the technical specifications.
• Evaluate the attack surface.
• Buy the product because it has "pretty colours" on the shelf.

📋 Summary of Delusions

• Belief that more layers = more security.
• Trust in the bug-free capabilities of software engineers.
• Overlooking the inherent flaws of x86.

---

💻 Conceptual Representation

If one were to represent this "security" layer in pseudo-code, it would look something like this:

void virtualization_layer() {
    while (system_running) {
        add_complexity();
        introduce_new_bugs();
        if (user_believes_it_is_secure) {
            printf("You've been smoking something mind altering.\n");
        }
    }
}

In short: Theo views the adoption of virtualization as a triumph of marketing over engineering reality.