[lkml]   [2008]   [Jul]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [stable] Linux
    On 17 Jul 2008 at 4:19, Rafael C. de Almeida wrote:

    > wrote:
    > > in other words, you should not be worrying about people not learning about
    > > all security fixes, they already know it's not possible to provide such
    > > information. however sharing your knowledge that you do have will *help*
    > > them because 1. they can know for sure it's something important to apply
    > > (no need to use their limited human resources to make that judgement),
    > > 2. they can spend more of their resources on analyzing the *other* unmarked
    > > fixes. overall this can only improve everyone's security.
    > Hey, I have a crazy idea! What if they just mark all the bugs as a
    > security bug (after all they all kinda are for some definition of
    > security anyway)? That way people just apply all the patches and do not
    > have to analyze anything, therefore not wasting their limited human
    > resources at all!
    > Linus' point is exactly that they shouldn't be treated differently,

    yet they already are, see below.

    > so you shouldn't allocate human resources to other bugs and just apply the
    > security ones. If you want to convince someone you must tell us *why*
    > those so-called security bugs are more important.

    look at what went into for example. it's a security fix. you do
    treat them differently: you include them in -stable to the exclusion of
    many other 'less important' fixes. read Documentation/stable_kernel_rules.txt
    for how you not treat all fixes as equal (it's not only security ones that
    are special cased).

    > Also, you need to tell
    > us what you consider to be a security bug. That's not clear to me at least.

    anything that breaks the kernel's security model. privilege elevation
    always does.

     \ /
      Last update: 2008-07-17 10:03    [W:0.023 / U:241.712 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site