[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <HP4s7z37GTsoDW43jgPPfFMSpfknopZFj995TBm7xpl2cc6CEmZGe6oZoXCXz81Ny11QA9ACQTGwluFzbMZyyFQv3hWuHd77hZ9VwApBptM=@protonmail.ch>
Date: Fri, 26 Jul 2019 12:59:25 +0000
From: Stiepan <stie@...tonmail.ch>
To: oss-security@...ts.openwall.com
Subject: Re: Security release pre-announcement messages
Thank you for the details.
Which color, the pony ? ;)
Regarding the a bug is a bug rationale you are referring to, I don't discuss it and think that much progress has been made to treat the subset of those which are also security bugs, including the enlightening participation of Mr. Torvalds himself to this list.
I wouldn't advocate cherry-picking bugfixes either, the Android examples you mention in your reference are a real nightmare indeed. My point is that we would have at any time the most secure available option. This would involve a system to switch among kernel versions when needed, eg when a "pure" security bug with high impact is identified and cannot be published yet, nor its fix, yet people could switch meanwhile to a safer, known kernel version.
I hope that makes it clearer.
Cheers,
Stiepan
Envoyé depuis ProtonMail mobile
-------- Message d'origine --------
On 26 juil. 2019 à 10:16, Greg KH a écrit :
> On Fri, Jul 26, 2019 at 10:14:08AM +0200, Greg KH wrote:
>> On Thu, Jul 25, 2019 at 09:35:45PM +0000, Stiepan wrote:
>> > I would like to congratulate the teams that do that. If public
>> > disclosure is deemed too dangerous before a patch is available, this
>> > looks like The reasonable tradeoff. Wish it was the same with Linux...
>>
>> I too want a pony :)
>>
>> > Rationale: people could switch meanwhile to a known safe kernel. That
>> > would provide peace of mind to the "rest of us" who don't have the
>> > keys to the linux-distros kingdom of the elected few, yet wish to have
>> > secure OSes, without a window of vulnerability open to whoever hacked
>> > into the elected few's machines (or are entitled another way to this
>> > secret information).
>> > It would also make Linux governance way more democratic, which seems
>> > to be a must for such a "too big to fail" core open-source software.
>>
>> The "best known safe kernel" is the latest one we release from the
>> stable kernel series. It has all of the fixes that that the kernel
>> developers possibly know about at that point in time.
>>
>> There's no need to worry about being on linux-distros or anything else,
>> just keep updating your kernel, test in in your infrastructure to ensure
>> it all works properly, and then push it out to all of your other systems
>> and all is good.
>
> And before all of the usual objections take place, please read this long
> write up:
> http://kroah.com/log/blog/2018/02/05/linux-kernel-release-model/
> specifically the "Security" section for details as to why the kernel
> does not do "pre-release" announcements.
>
> thanks,
>
> greg k-h
Content of type "text/html" skipped
Download attachment "publickey - stie@...tonmail.ch - 0xADF18750.asc" of type "application/pgp-keys" (1761 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
