Handling kernel security problems

Handling kernel security problems

Posted Jul 16, 2008 22:06 UTC (Wed) by nix (subscriber, #2304)
In reply to: Handling kernel security problems by tialaramex
Parent article: Handling kernel security problems

Only someone who relies on "grep" to the exclusion of actual thought processes would be so obsessed with seeing phrases like "exploitable overflow" introduced into the Linux changelogs, particularly in places where the "exploit" is arcane and entirely theoretical

I'd say that this clearly does not describe the PaX or grsecurity hackers. They do know their stuff and are quite capable of identifying security holes without grep (even if they do jump the gun now and then and identify things as threats that aren't). I suspect that they think that this does describe random sysadmins using -stable kernels, perhaps on the mistaken assumption that most people use Linus's kernels these days (an understandable assumption for the maintainers of kernel patches: after all, they do), and so therefore the -stable descriptions must be such that the braindead can understand 'upgrade now'. (Why statements like 'upgrade now' in the -stable kernel announcements are still considered unacceptable 'coverups' I have no clue.)

(I'd be surprised if there were many braindead people tracking the stable kernels, myself, but it's an understandable viewpoint.)

---

(Log in to post comments)