linux-kernel - Re: Planned changes for bugzilla.kernel.org to reduce the "Bugzilla blues"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMuHMdUgxmTCcx2v_jhO7iF6NEwjDHesX2LLAgrdFFUYxiRcAQ@mail.gmail.com>
Date:   Sun, 2 Oct 2022 11:25:31 +0200
From:   Geert Uytterhoeven <geert@...ux-m68k.org>
To:     "Artem S. Tashkinov" <aros@....com>
Cc:     Thorsten Leemhuis <linux@...mhuis.info>,
        Greg KH <gregkh@...uxfoundation.org>,
        Konstantin Ryabitsev <konstantin@...uxfoundation.org>,
        workflows@...r.kernel.org, LKML <linux-kernel@...r.kernel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        "regressions@...ts.linux.dev" <regressions@...ts.linux.dev>,
        ksummit@...ts.linux.dev
Subject: Re: Planned changes for bugzilla.kernel.org to reduce the "Bugzilla blues"

Hi Artem,

On Sun, Oct 2, 2022 at 11:07 AM Artem S. Tashkinov <aros@....com> wrote:
> On 10/2/22 09:03, Geert Uytterhoeven wrote:
> > On Sat, Oct 1, 2022 at 1:21 PM Artem S. Tashkinov <aros@....com> wrote:
> >> On 10/1/22 10:57, Thorsten Leemhuis wrote:
> >>> On 01.10.22 12:47, Artem S. Tashkinov wrote:
> >>>> On 10/1/22 10:39, Greg KH wrote:
> >>>>> On Sat, Oct 01, 2022 at 10:30:22AM +0000, Artem S. Tashkinov wrote:
> >>>
> >>>>>> I have a 20+ years experience in IT and some kernel issues are just
> >>>>>> baffling in terms of trying to understand what to do about them.
> >>>>>>
> >>>>>> Here's an example: https://bugzilla.kernel.org/show_bug.cgi?id=216274
> >>>>>>
> >>>>>> What should I do about that? Who's responsible for this? Who should I
> >>>>>> CC?
> >>>>>
> >>>>> Input subsystem.
> >>>>
> >>>> It's great you've replied immediately, what about hundreds or even
> >>>> thousands of other bug reports where people have no clue who has to be
> >>>> CC'ed?
> >>>
> >>> Quoting from https://docs.kernel.org/admin-guide/reporting-issues.html:
> >>>
> >>> "[...] try your best guess which kernel part might be causing the issue.
> >>> Check the MAINTAINERS file [...] In case tricks like these don’t bring
> >>> you any further, try to search the internet on how to narrow down the
> >>> driver or subsystem in question. And if you are unsure which it is: just
> >>> try your best guess, somebody will help you if you guessed poorly. [...]"
> >>>
> >>> HTH, Ciao, Thorsten
> >>
> >> Absolute most people:
> >>
> >> * Will never read this document
> >> * Will not be able to "search the internet on how to narrow down the
> >> driver or subsystem in question"
> >
> > So how did these people arrive at "bugzilla" in the first place? ;-)
>
> Google kernel bug -> bugzilla.kernel.org

First three hits:

  1. Google just tripled its bounty for Linux kernel bugs. Here's
whyhttps://www.zdnet.com › Innovation › Security
     02 Nov 2021 — Google has kicked off a special three-month bug
bounty targeting flaws in the Linux kernel with triple the rewards for
security researchers.

  2. Google's New Bug Bounties Include Their Custom Linux
...https://linux.slashdot.org › story › googles-new-bug-bo...
     13 Aug 2022 — All of GKE and its dependencies are in scope, but
every flag caught so far has been a container breakout through a Linux
kernel vulnerability.

  3. How to report Linux kernel bugs - google/syzkaller -
GitHubhttps://github.com › syzkaller › blob › master › docs
     Reporting Linux kernel bugs. Before reporting a bug make sure
nobody else already reported it. The easiest way to do this is to
search through the syzkaller ...

Bingo, that page tells you to use the MAINTAINERS file.
Nothing about bugzilla on the first page (Google is adapting quickly ;-)

> > Or is this a case of "if all you have is a hammer...", so you
> > actively start looking for a bugzilla?
> > I.e. people who are used to bugzilla/discourse/slack/irc/trac/... will
> > look for how to use bugzilla/discourse/slack/irc/trac/... to interact
> > with the developer and/or maintainer.
> >
> > The definitive guide is the MAINTAINERS file.  If there is a (rare)
> > corresponding "B" entry, you can use that.  Else fall back to the
> > "M" and "L" entries.  "C" might be good for an initial query, but not
> > for the actual reporting, as there's even less traceability than with
> > mailing lists (the latter are archived by lore).
>
> Just like I said before email sucks terribly for bug reporting except
> for rare cases when the developer notices your email right away and
> promptly submits a patch. This happens once in a blue moon unfortunately.

During the last decade, I received three emails from kernel bugzilla
(four including the "please change your password" email).

The first one was incorrectly assigned to me, but closest as fixed
later.
The second was fixed by the reporter after feedback from someone else.
The third was a complex configuration issue (think randconfig) that
was not trivial to fix, but doesn't matter in the real world.

Now, for bug reports by email that I did fix, I cannot give you the
details easily, as the list would be a few orders of magnitude larger...

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@...ux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds