linux-kernel - Re: [Ksummit-discuss] bug-introducing patches

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 08 May 2018 15:41:37 -0700
From:   James Bottomley <James.Bottomley@...senPartnership.com>
To:     Sasha Levin <Alexander.Levin@...rosoft.com>,
        David Lang <david@...g.hm>
Cc:     "ksummit-discuss@...ts.linuxfoundation.org" 
        <ksummit-discuss@...ts.linuxfoundation.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        "w@....eu" <w@....eu>
Subject: Re: [Ksummit-discuss] bug-introducing patches

On Tue, 2018-05-08 at 21:43 +0000, Sasha Levin via Ksummit-discuss
wrote:
> On Tue, May 08, 2018 at 01:59:18PM -0700, David Lang wrote:
> > On Tue, 8 May 2018, Sasha Levin wrote:
> > 
> > > There's no one, for example, who picked up vanilla v4.16 and
> > > plans to keep using it for a year.
> > 
> > Actually, at a prior job I would do almost exactly that.
> > 
> > I never intended to go a year without updating, but it would happen
> > if  nothing came up that was related to the hardware/features I
> > was running.
> > 
> > so 'no one uses the Linus kernel is false.
> 
> My point is not that "no one ever uses Linus kernel" but that no one
> takes one of those kernels and plans to stick with it for 3 months
> until the next one comes up, even if there are updates relevant to
> that user..

Actually, I have sometimes done that.  My current laptop is running the
v4.16 tag now, not because I intended to run it for this long but
because I've run into a Round Tuit shortage as far as the -rc
candidates go.

> Yes, some users will use a .0 release until either Greg releases a
> -stable, or until the next -rc is out.
> 
> What I'm trying to say is that there is that the .0 release makes
> some people rush poorly tested commits in it even though the .0
> release is not significant in any way.

As a milestone, it's extremely significant because it's the cadence
from which everything else flows.  If we as developers stop taking the
-rc cycle seriously, you'll find immediate negative consequences for
your stable kernels.  And I mean way worse consequences than the odd
bad judgment call about a patch that ought not to have gone in right
before a Linus release.

James