linux-kernel - Re: "Link in bio" instead of Link:/Closes: trailer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 22 Dec 2023 19:42:35 -0500
From: "Theodore Ts'o" <tytso@....edu>
To: Bagas Sanjaya <bagasdotme@...il.com>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Jakub Kicinski <kuba@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Staging Drivers <linux-staging@...ts.linux.dev>
Subject: Re: "Link in bio" instead of Link:/Closes: trailer

On Thu, Dec 21, 2023 at 09:13:32PM +0700, Bagas Sanjaya wrote:
> I was scratching my itch whether common social media practices (such as that's
> being discussed here) can be applied to kernel development.

The real problem is that someone's soecial media profile (whether it's
Linkedin, or Facebook, or Threads, or Twitter) is not a stable, fixed
resource.  So at any time in the future, the bug report in the Social
media profile could get modified, or disappear when Elon Musk decides
to take a user's Twitter username[1] away so he can resell the highly
desireable account name to someone he likes better.  The git log is
forever.  So pointing to a transient resource from a permanent log is
a really, Really, REALLY bad idea.

[1] https://slate.com/technology/2023/08/x-twitter-usernames-music-take-away-interview.html

Common social media practices are often quite terrible, and this is a
great example about why they shouldn't be used for this purpose.  The
bug report should be sent to a linux kernel mailing list, so everyone
can see it, and then they can use a lore.kernel.org URL as the stable
resource.

If the bug report is in some other source where the people who run it
understand the importance of stable information at stable URL's ---
for example, bugzilla.kernel.org, bugzilla.redhat.com,
bugs.debian.org, etc. that's also fine.  But a social media profile,
which can be modified at the owner's whim (either of the social media
account, or the social media comapny, or someone who has $44 billion
dollars to carelessly throw around)?  That way lies madness.

Just because something might "common social media pracitce", doesn't
mean that it's a good idea.  In fact, some might argue that much of
what happens on social media has a negative value to society, but
that's a different debate....

Cheers,

					- Ted