linux-kernel - Re: [ANNOUNCE] linux-stable security tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 11 Apr 2016 23:35:08 -0700
From:	Greg KH <gregkh@...uxfoundation.org>
To:	Willy Tarreau <w@....eu>
Cc:	Sasha Levin <sasha.levin@...cle.com>,
	LKML <linux-kernel@...r.kernel.org>,
	stable <stable@...r.kernel.org>, lwn@....net
Subject: Re: [ANNOUNCE] linux-stable security tree

On Tue, Apr 12, 2016 at 08:22:37AM +0200, Willy Tarreau wrote:
> I think we may have more of an issue educating our users than an issue
> with the code we distribute.

I think that's the issue here, combined with users that just don't want
to upgrade as it's "hard" for them.  There's nothing we can do about
making it easier than we already do, and really, taking 200 patches is
just the same work for them to take 100 patches in a release, so I
don't buy the "I only want a small subset of fixes" argument, as it
doesn't make any sense.

So I worry that this tree will give people a _false_ sense of security,
thinking that they have properly covered the needed fixes when really,
there are lots of fixes they didn't even know they needed that got
applied to the "normal" stable tree for issues they will hit.

Also, people need to stop being afraid of the large numbers of stable
patches, and compare it to the overall % of changes, and realize that
what we take in stable releases is really a trivially small number of
the overall changes made to the kernel.  So much so that you might argue
that it's safer to run the real kernel releases and not rely on stable
releases :)

thanks,

greg k-h