linux-kernel - Re: Number of bugs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080522181145.GE2727@cs181133002.pp.htv.fi>
Date:	Thu, 22 May 2008 21:11:45 +0300
From:	Adrian Bunk <bunk@...nel.org>
To:	Natalie Protasevich <protasnb@...il.com>
Cc:	Arjan van de Ven <arjan@...radead.org>,
	Bosko Radivojevic <bosko.radivojevic@...il.com>,
	linux-kernel@...r.kernel.org
Subject: Re: Number of bugs - statistics

On Thu, May 22, 2008 at 10:51:49AM -0700, Natalie Protasevich wrote:
> On Thu, May 22, 2008 at 10:33 AM, Adrian Bunk <bunk@...nel.org> wrote:
> > On Thu, May 22, 2008 at 10:08:49AM -0700, Natalie Protasevich wrote:
> >> On Thu, May 22, 2008 at 9:50 AM, Adrian Bunk <bunk@...nel.org> wrote:
> >>...
> >> >> by various criteria: ALSA bugs
> >> >> are numerous, which is not important for most enterprise server users
> >> >> who would completely disregard this category, whereas desktop users
> >> >> will probably concentrate on those more than any other.
> >> >
> >> > The majority of machines running Linux most likely runs with ARM CPUs.
> >> >
> >> > Show me any public source you want to use for getting serious data for
> >> > this area.
> >>
> >> There is no one, except dispersed reports and ... appropriate
> >> implementation involving search engine comes to mind.
> >
> > Much of this information will never be published at any place where
> > Google could find it.
> 
> But Adrian, there will be a chain reaction. That's why Andrew
> encourages interested parties from industry share code (which will
> mean bug reports). This is gradual process, way of collaboration and
> open source is being more and more accepted and even urged.

That's a completely different thing.

Example for what I'm talking about:

Customer says:
We know $driver in the kernel for their device is buggy, but they are 
the only ones manufacturing this kind of device we need.

Customer uses the device as part of some machines he sells.

Neither the manufactorer nor the customer do want to _ever_ become 
publically known that there are bugs in the device.

And that's not a made-up example, I know names for manufactorer and 
customer for such cases.

> >> >> So the answer
> >> >> to question about kernel stability would be more adequate depending on
> >> >> who's asking.
> >> >
> >> > You must not confuse "number of reported bugs" with "kernel stability" -
> >> > these two can be quite decoupled.
> >>
> >> Number of existing, proven and prioritized  bugs maybe better to say.
> >> I think there is a correlation.
> >
> > Some correlaton.
> >
> > If people are aware of the weaknesses and the many obvious ways to
> > manipulate such statistics.
> 
> ... which needs to start and take its own development cycle. Then it
> will become more sophisticated.

We do not need more sophisticated statistics, we need to find ways to 
get the bugs fixed.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/