linux-kernel - Re: [stable] Linux 2.6.25.10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <487DE3CA.5722.1ECB175D@pageexec.freemail.hu>
Date:	Wed, 16 Jul 2008 12:04:26 +0200
From:	pageexec@...email.hu
To:	Gabor Gombas <gombasg@...aki.hu>
CC:	Tiago Assumpcao <tiago@...umpcao.org>, Greg KH <greg@...ah.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, stable@...nel.org
Subject: Re: [stable] Linux 2.6.25.10

On 16 Jul 2008 at 11:35, Gabor Gombas wrote:

> On Wed, Jul 16, 2008 at 11:01:51AM +0200, pageexec@...email.hu wrote:
> 
> > very good example of how you actually do *not* do what you claim. find me
> > the word 'security' in your announcement. it's not there. amazing, isn't it.
> > despite what your fellow -stable maintainer claimed *he* would at least do
> > (and regularly tries to do so in fact). despite what you yourself did on
> > other occasions (remember 2.6.23.8?). what's wrong with you Greg? have you
> > not been told and proven to cover up security bugs enough times already?
> 
> Huh? Have you read the announcement? If one do not understand from the
> wording that this _is_ a security fix then he/she is stupid beyond hope.

i understand what it is, i would understand it even if it said even
less.

what does this have to do with carefully avoiding the word 'security'
on one hand and disclosing it on another? do you understand the word
'consistency' or are you 'stupid beyond hope'?

> And I see that the biggest difference between you and the kernel
> developers:

no you don't see it. you haven't even read or understood all the
discussion else you would not be making stupid claims as below:

> the kernel developers want you to _think_ whether that
> particular patch is important for you or not.

are you out of your mind? since when it is the job of users (meaning,
users of commit logs) to reverse engineer what the heck the given
commit was supposed to actually fix? do you think they don't have
better use of their time? if there is a purpose of a commit message
then it's that of informing the reader, not confusing or misleading
him.

> You on the other hand want
> to be able to mindlessly apply patches marked as "security fix"

what is mindless about applying a security fix?

> without
> any consideration about how all the other unfixed bugs can bite you.

where did i say that people should apply security fixes without
considering other, unmarked fixes? i said the exact opposite which
you would know if you had actually cared to read the thread in its
entirety.

udv,
  PaX Team

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/