linux-kernel - Re: [PATCH] Replace HTTP links with HTTPS ones: USB MASS STORAGE DRIVER

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200708103928.GC585606@kroah.com>
Date:   Wed, 8 Jul 2020 12:39:28 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     "Alexander A. Klimov" <grandmaster@...klimov.de>
Cc:     stern@...land.harvard.edu, linux-usb@...r.kernel.org,
        usb-storage@...ts.one-eyed-alien.net, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Replace HTTP links with HTTPS ones: USB MASS STORAGE
 DRIVER

On Wed, Jul 08, 2020 at 11:55:00AM +0200, Alexander A. Klimov wrote:
> Rationale:
> Reduces attack surface on kernel devs opening the links for MITM
> as HTTPS traffic is much harder to manipulate.
> 
> Deterministic algorithm:
> For each file:
>   If not .svg:
>     For each line:
>       If doesn't contain `\bxmlns\b`:
>         For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
> 	  If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`:
>             If both the HTTP and HTTPS versions
>             return 200 OK and serve the same content:
>               Replace HTTP with HTTPS.
> 
> Signed-off-by: Alexander A. Klimov <grandmaster@...klimov.de>

Your subject lines are very odd compared to all patches for this
subsystem, as well as all other kernel subsystems.  Any reason you are
doing it this way and not the normal and standard method of:
	USB: storage: replace http links with https

That would look more uniform as well as not shout at anyone.

thanks,

greg k-h