[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAFUG7CciO_ZUMdjcOCfOtoi+YEni2+a-9QkcsCj1nox0NqHj0A@mail.gmail.com>
Date: Fri, 6 Nov 2026 16:00:48 -0500
From: Boris Lukashev <blukashev@...pervictus.com>
To: Nakashima Seiichi <s-nakashima@....biglobe.ne.jp>
Cc: Greg KH <gregkh@...uxfoundation.org>, kernel-hardening@...ts.openwall.com,
mic@...ikod.net, paul@...l-moore.com
Subject: Re: [RFC idea] Kernel API Firewall (kaf): subsystem-level attack
surface reduction for the post-AI-CVE era
@Nakashima Seiichi: To be fair it's actually "pick a better kernel" such as
one with a security model starting at the execution and MMU layers since
the fundamental problem with doing this at higher-levels comes down to
mutable, type-confused, and improperly accessible memory (on-stack or via
alloc) atop which the rest of what you describe has to be built. Castles
built on sand with the added twist of ML tech adding grandfather worms
straight from Dune.
@Greg KH: there is no practical choice for using anything but what's
prescribed by the vendor and contractually supported in the commercial
world (further complicated by binary blobs/device trees/intellectual
property concerns/etc). You cant ask the hotel to change the kiosk
distribution to a safer one in order to check you in despite them having
your PII and payment data running through it any more than the rest of us
despite your undeniable awareness of the threat involved. It would be far
more realistic and practical for the Linux Foundation to assign its
seasoned talent to work on downstream distributions of economic relevance
to its member entities than to swap out the OS' in the clustered engine of
today's economy.
-Boris
On Fri, Nov 6, 2026 at 2:07 PM Nakashima Seiichi <
s-nakashima@....biglobe.ne.jp> wrote:
>
> >
> > Pick a better distro. Seriously, if the distro you are paying for
> > isn't
> > keeping it up to date and secure, what are you paying them for?
> > Seems
> > like an odd choice to stick with them given you have a contract
> > saying
> > they need to abide by it...
> >
> > good luck!
> >
> > greg k-h
>
>
> Thank you for your comment. Given the high volume of vulnerability-
> related issues lately, I simply shared some ideas in the hope that they
> might help with improvements.
>
--
Boris Lukashev
Systems Architect
Semper Victus <https://www.sempervictus.com>
Content of type "text/html" skipped
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
