linux-kernel - Re: [PATCH 01/12] thinkpad_ec: New driver for ThinkPad embedded controller access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41840b750608061508j9e731c4hf9de7b389c46c916@mail.gmail.com>
Date:	Mon, 7 Aug 2006 01:08:40 +0300
From:	"Shem Multinymous" <multinymous@...il.com>
To:	"Theodore Tso" <tytso@....edu>
Cc:	"Andrew Morton" <akpm@...l.org>, rlove@...ve.org,
	khali@...ux-fr.org, gregkh@...e.de, alan@...rguk.ukuu.org.uk,
	linux-kernel@...r.kernel.org, hdaps-devel@...ts.sourceforge.net
Subject: Re: [PATCH 01/12] thinkpad_ec: New driver for ThinkPad embedded controller access

Hi Ted,

Thanks for the explanation. Point taken, though I can't help parsing it as:

On 8/6/06, Theodore Tso <tytso@....edu> wrote:
> For legal reasons, we need a way to to contact and identify the author
> in the real world, not just in cyberspace, and a pseudonym doesn't
> meet that requirement.

"We want to be able to sue you if they sue us."

Which is actually not a problem for me (i.e., I don't believe I have
nothing to worry about legally); but I do have other, non-legal
considerations.

> just as the fact that we aren't requiring ink signatures and public notary
> checks doesn't mean we shouldn't stop doing what we are doing.

Understood, but still a bit silly. You have no idea how many of the
2252 people in `git-whatchanged | grep Signed-off-by: | sort | uniq`
gave their legal name, and I doubt you could contact most of them in
the real world without their cooperation (and with my cooperation, you
could contact me too). Heck, some of those email domains don't even
resolve. So this "chain of responsibiliy" is pretty worthless if
someone really tries to inject legally malicious code into mainline,
i.e., you end up blindly trusting people anyway.

BTW, Ted, we actually have met in person. :-)

  Shem
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/