NEWS: @Google funds Linux kernel developers to focus exclusively on security: https://bit.ly/3pUnrL4 #linux #linuxkernel #security #supplychain #oss @nathanchance
-
-
W odpowiedzi do to @linuxfoundation@CloudNativeFdn i jeszcze
Serious question: Does that mean there's a chance Linux will do proper CVE, marking of releases, etc going forward? Last time I looked, it was still the fundamentally wrong "SeCuRiTy BuGs ArE lIkE aLl OtHeR bUgS" game.
1 odpowiedź 0 podanych dalej 3 polubione -
W odpowiedzi do to @TwitchiH@linuxfoundation i jeszcze
At the Linux kernel level, yes, they still treat all bugs as potential security vulnerabilities.
@gregkh can explain why better than I can.1 odpowiedź 0 podanych dalej 1 polubiony -
W odpowiedzi do to @mdolan@linuxfoundation i jeszcze
I meant the inverse of Linus arguing that security fixes don't need to be marked specifically which makes downstream work and upgrades needlessly hard.
2 odpowiedzi 0 podanych dalej 0 polubionych -
"downstream" only has to take the weekly stable/LTS releases to get all known security and bug fixes (i.e. security fixes we don't know about yet). How much easier can it get for them, we provide it all fully tested!
2 odpowiedzi 1 podany dalej 4 polubione -
And if you want to know more about why CVEs are totally broken, especially for a project like the kernel, see my hour long talk: https://kernel-recipes.org/en/2019/talks/cves-are-dead-long-live-the-cve/ …
1 odpowiedź 5 podanych dalej 9 polubionych -
Given that upgrading is not always painless, knowing if a currently-used version is secure for a specific use case is still valuable as it can help defer non-essential upgrades. That being said, I will put your talk onto my backlog and honestly look forward to watching it.
2 odpowiedzi 0 podanych dalej 0 polubionych -
Upgrading your kernel should _always_ be painless. Unless you depend on out-of-tree changes, and if so, well, that's your fault for trusting them, nothing the kernel community can do about them obviously.
1 odpowiedź 5 podanych dalej 22 polubione -
The kernel itself, yes. I was referring to rebooting the system to run the new kernel. A lot easier now that most machines and services are cattle, but still. Also, just because it's painless does not mean everyone wants to upgrade immediately if everything's running nicely.
1 odpowiedź 0 podanych dalej 0 polubionych
That's pretty foolish, if everything is "running nicely", you are still "vulnerable to all public bugs that have been fixed", so odds are "running nicely" isn't really happening if you are connected to the world in any way :)
-
-
Only if the bug can be triggered by other users on the same system, or remotely. We could, foolishly, call them vulnerabilities and classify them differently from other bugs.
1 odpowiedź 0 podanych dalej 0 polubionych -
Ah, but who is going to do the work to determine if the 30 patches a day I merge to the stable releases should be classified that way or not? That's the issue, no one can do that, so treat "a bug is a bug is a bug" and just update and move on. "classification" never works.
1 odpowiedź 0 podanych dalej 5 polubionych - Pokaż odpowiedzi
Nowa rozmowa -
Wydaje się, że ładowanie zajmuje dużo czasu.
Twitter jest przeciążony lub wystąpił chwilowy problem. Spróbuj ponownie lub sprawdź status Twittera, aby uzyskać więcej informacji.