oss-security - Re: Security release pre-announcement messages

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190726081640.GA4778@kroah.com>
Date: Fri, 26 Jul 2019 10:16:40 +0200
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: Security release pre-announcement messages

On Fri, Jul 26, 2019 at 10:14:08AM +0200, Greg KH wrote:
> On Thu, Jul 25, 2019 at 09:35:45PM +0000, Stiepan wrote:
> > I would like to congratulate the teams that do that. If public
> > disclosure is deemed too dangerous before a patch is available, this
> > looks like The reasonable tradeoff. Wish it was the same with Linux...
> 
> I too want a pony :)
> 
> > Rationale: people could switch meanwhile to a known safe kernel. That
> > would provide peace of mind to the "rest of us" who don't have the
> > keys to the linux-distros kingdom of the elected few, yet wish to have
> > secure OSes, without a window of vulnerability open to whoever hacked
> > into the elected few's machines (or are entitled another way to this
> > secret information).
> > It would also make Linux governance way more democratic, which seems
> > to be a must for such a "too big to fail" core open-source software.
> 
> The "best known safe kernel" is the latest one we release from the
> stable kernel series.  It has all of the fixes that that the kernel
> developers possibly know about at that point in time.
> 
> There's no need to worry about being on linux-distros or anything else,
> just keep updating your kernel, test in in your infrastructure to ensure
> it all works properly, and then push it out to all of your other systems
> and all is good.

And before all of the usual objections take place, please read this long
write up:
	http://kroah.com/log/blog/2018/02/05/linux-kernel-release-model/
specifically the "Security" section for details as to why the kernel
does not do "pre-release" announcements.

thanks,

greg k-h

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.