linux-kernel - Re: [RFC PATCH] x86/kconfig: Sanity-check config file during oldconfig

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <yw1xk2n6sxlj.fsf@unicorn.mansr.com>
Date:	Mon, 18 Jan 2016 15:42:32 +0000
From:	Måns Rullgård <mans@...sr.com>
To:	Borislav Petkov <bp@...e.de>
Cc:	Thomas Voegtle <tv@...96.de>, Michal Marek <mmarek@...e.cz>,
	Markus Trippelsdorf <markus@...ppelsdorf.de>,
	linux-kernel@...r.kernel.org, x86-ml <x86@...nel.org>
Subject: Re: [RFC PATCH] x86/kconfig: Sanity-check config file during oldconfig

Borislav Petkov <bp@...e.de> writes:

> On Mon, Jan 18, 2016 at 02:51:00PM +0000, Måns Rullgård wrote:
>> I understand and disagree.  I think you're being overzealous in trying
>> to bludgeon people into doing things the way you think they should be
>> done.
>
> So I did explain why it is better to do microcode updates from the
> initrd. And nowhere in that explanation I am "bludgeoning" people into
> doing things the way I want. Which is silly, I'd never even *think* of
> wanting to do that - I have enough other shit to deal with.

Forcing users to press a damn key on the keyboard after your pointless
warning message sure feels like bludgeoning to me.

>> From the point of view of the actual update mechanism, what difference
>> does it make where the microcode data was retrieved from?  If you want
>> to warn about what you consider "unsafe" updates, do that when the
>> update happens instead.  With this patch, simply enabling BLK_DEV_INITRD
>> will shut up the warning even if an initrd is never actually used.
>> Also, what do modules have to do with anything?
>
> This reads like your mail from a couple of days ago. Which leads me to
> think that you haven't understood at all what I've been writing this
> whole time.

Clearly you didn't explain it very well.

-- 
Måns Rullgård