[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2026110719-zipping-silliness-2443@gregkh>
Date: Sat, 7 Nov 2026 07:04:50 -0500
From: Greg KH <gregkh@...uxfoundation.org>
To: Boris Lukashev <blukashev@...pervictus.com>
Cc: Nakashima Seiichi <s-nakashima@....biglobe.ne.jp>,
kernel-hardening@...ts.openwall.com, mic@...ikod.net,
paul@...l-moore.com
Subject: Re: [RFC idea] Kernel API Firewall (kaf): subsystem-level attack
surface reduction for the post-AI-CVE era
On Fri, Nov 06, 2026 at 04:00:48PM -0500, Boris Lukashev wrote:
> @Greg KH: there is no practical choice for using anything but what's
> prescribed by the vendor and contractually supported in the commercial
> world (further complicated by binary blobs/device trees/intellectual
> property concerns/etc). You cant ask the hotel to change the kiosk
> distribution to a safer one in order to check you in despite them having
> your PII and payment data running through it any more than the rest of us
> despite your undeniable awareness of the threat involved. It would be far
> more realistic and practical for the Linux Foundation to assign its
> seasoned talent to work on downstream distributions of economic relevance
> to its member entities than to swap out the OS' in the clustered engine of
> today's economy.
So, it's not enough that the kernel developers and stable maintainers
provide a free feed of 75 fixes a day in a tested and released kernel,
and 55 documented CVE fixes a day, they then are required to, for free,
take those patches and integrate them into for-profit company's kernels
for them because that for-profit company doesn't want to pay for that
effort to meet the contractual requirements that their customers pay for
them to meet?
If you take the "pure numbers" point of view, that means that we should
do this only for Debian and Yocto as those distros hold the huge
majority of all of the server and embedded systems numbers in the world,
everything else is just a tiny percent. Oh wait, the LF already does
this for you, for Yocto, and Debian is also free and up to date with all
of these security issues for you to rely on.
So again, why not hold the companies that you feel are worth paying for
this service, responsible for meeting their own self-defined
contractural requirements? Given that the community is giving all of
this to them for free, it's odd that anyone would ask for us to do more
work than that, don't you agree?
greg k-h
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
