linux-kernel - Re: Coverity Scan model file, license, public access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Tue, 6 Jul 2021 20:41:54 +0200
From:   Kroah-Hartman <greg@...ah.com>
To:     Norbert Manthey <nmanthey@...zon.de>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        "Woodhouse, David" <dwmw@...zon.co.uk>,
        "foersleo@...zon.de" <foersleo@...zon.de>,
        Gustavo Pimentel <gustavo.pimentel@...opsys.com>,
        "Gustavo A. R. Silva" <garsilva@...eddedor.com>,
        Kees Cook <keescook@...omium.org>,
        Thomas Gleixner <tglx@...utronix.de>
Subject: Re: Coverity Scan model file, license, public access

On Tue, Jul 06, 2021 at 08:34:16PM +0200, Norbert Manthey wrote:
> With respect to sharing the results: we are allowed to upstream fixes
> that we find with the tool. We contributed in that way already, e.g. [2].

Yes, that is how many companies do this and have for a long time
(Canonical does this a lot).  But that puts all the work on you, and you
can not share the results of the tool with anyone, so you are forced to
do the work to fix problems the tool reports, which feels really wrong
when you are dealing with a scan of a public source tree...

thanks,

greg k-h