linux-kernel - Re: [RFC] syzbot process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Dec 2017 10:08:51 -0800
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Andrey Ryabinin <ryabinin.a.a@...il.com>
Cc:     Dmitry Vyukov <dvyukov@...gle.com>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Eric Biggers <ebiggers3@...il.com>,
        Kostya Serebryany <kcc@...gle.com>,
        Alexander Potapenko <glider@...gle.com>,
        andreyknvl <andreyknvl@...gle.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>,
        David Miller <davem@...emloft.net>,
        Willem de Bruijn <willemb@...gle.com>,
        Guenter Roeck <groeck@...gle.com>,
        Stephan Mueller <smueller@...onox.de>
Subject: Re: [RFC] syzbot process

On Thu, Dec 21, 2017 at 5:22 AM, Andrey Ryabinin <ryabinin.a.a@...il.com> wrote:
>
>      instead of
>      From: syzbot <syzkaller@...glegroups.com>
>
>      make it
>      From: syzbot-{hash} <syzkaller@...glegroups.com>

That is probably good, but people drop the name all the time.

But with a very simple tweak, I think this would be close to perfect:
put the hash in the original email instead, and use "+" instead of
"-", because that's the standard email ("latter part doesn't matter").
Skip the proper name part entirely, since it doesn't really add
anything.

And then make it show up in the "Cc:" part or "Reported-by:", so it
would just look something like

    Reported-by: syzkaller+1234abc@...glegroups.com

and you're all done. I think that would be easiest for us to track
(just one email that we're supposed to put in the commit message
_anyway_), and I hope/think that all email clients and servers will
still maintain the original full "syzkaller+xyz" part of the email, so
it doesn't get lost.

Because the "proper name" part definitely does get lost occasionally.
I'm not sure why it happens, but it definitely happens quite often.

                   Linus