[lkml]   [2008]   [Jul]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: The state of linux security
On Wed, 16 Jul 2008, Cheradenine Zakalwe wrote:

> If it turns out that the current development model has produced too
> many security problems then the development model must change. I'd
> like to think that the integrity of most peoples systems is more
> important than some micro benchmark improvement because of some
> complex scheduler change. That's not to say the latter isn't
> important, just that more time and effort needs to be put into making
> sure that the changes don't affect users in potentially disasterous
> ways.

how can you tell for sure if a bug has security implications or not?

the argument can be made that just about any bug can be a security bug

frequently the security implications of a bug are not known at the time
it's fixed, but are discovered later. how do you expect to have this in
the announcements?

if you only upgrade when there is a 'security bug' announcement you will
miss a lot of important upgrades.

as Linus stated, there's nothing preventing anyone who thinks that he's
not doing an appropriate job from doing the research on the security
implications of everything and doing their own announcements or just
maintaining their own tree.

David Lang

 \ /
  Last update: 2008-07-16 18:39    [W:0.109 / U:4.768 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site