linux-kernel - Re: [stable] Linux 2.6.25.10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 16 Jul 2008 13:52:27 +0200
From:	pageexec@...email.hu
To:	David Miller <davem@...emloft.net>
CC:	tiago@...umpcao.org, torvalds@...ux-foundation.org, greg@...ah.com,
	akpm@...ux-foundation.org, linux-kernel@...r.kernel.org,
	stable@...nel.org
Subject: Re: [stable] Linux 2.6.25.10

On 16 Jul 2008 at 4:04, David Miller wrote:

> From: pageexec@...email.hu
> Date: Wed, 16 Jul 2008 12:51:31 +0200
> 
> > On 16 Jul 2008 at 3:31, David Miller wrote:
> > 
> > > From: pageexec@...email.hu
> > > Date: Wed, 16 Jul 2008 12:23:50 +0200
> > > 
> > > > On 16 Jul 2008 at 3:08, David Miller wrote:
> > > > 
> > > > > IOW, when we fix security issues, it's simply not even appropriate or 
> > > > > relevant to you.
> > > > 
> > > > i'll ask again: why aren't security fixes that you fix relevant to users
> > > > of older kernels (as that's what the topic was)?
> > > 
> > > Backporting any fix to older kernels is a chore, the further back you
> > > go, the harder and less fun it is.
>  ...
> > > The tipping point is really quick to where someone hacking the kernel
> > > for fun simply isn't going to do it, nor should they be expected to.
> > > 
> > > That's why people who want a stable supported kernel with fixes
> > > constantly backported have grown accustomed to paying for that service.
> > 
> > and how does that imply that you should not mark security fixes as such?
> 
> You asked me why fixes are not relevant to users of older upstream
> non-dist kernels.  And I answered that question.

no you did not because that was not my question actually. i wasn't
asking about 'older upstream non-dist kernels' but 'older kernels',
regardless of their being of vanilla or distro or whatever variety.
here it is again (you even quoted it above btw):

  "why aren't security fixes that you fix relevant to users of older kernels"

it doesn't say 'distro'. in fact, i chose my words carefully as there
seems to be a tendency among you guys where you simply ignore or don't
care about the interests of several user groups. there's a whole world
beyond Red Hat and Novell, and some of those people are very well
capable of backporting fixes, so your 'it is too labourious to backport
therefore we don't mark security fixes' argument is simply wrong (an in
all honesty, it's not up to you guys to decide what people are capable or
willing to backport, your responsibility should be to help them, no make
decisions for them). if you want an inside voice, go ask the 2.4 maintainer.
i quoted him already here already in fact:

  I don't like obfuscation at all WRT security issues, it does far more
  harm than good because it reduces the probability to get them picked
  and fixed by users, maintainers, distro packagers, etc...
  (http://lkml.org/lkml/2008/6/10/452)

so what's the next 'justification' for covering up security bugs?

cheers,
  PaX Team

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/