User: Password:
Subscribe / Log in / New account's road to recovery's road to recovery

Posted Oct 11, 2011 10:34 UTC (Tue) by PaXTeam (guest, #24616)
In reply to:'s road to recovery by mpr22
Parent article:'s road to recovery

right and we're talking about linux here, so give it another try. like, show me poeple who work for companies/distros of any significance (in terms of user base) *and* live under this mistaken belief. otherwise you've got no argument. also, this software you mentioned, do its authors publish security errata? do they mark security fixes explictly? did you tell them that they must at once stop doing that because it'll cause unspeakable damage?

(Log in to post comments)'s road to recovery

Posted Oct 11, 2011 18:58 UTC (Tue) by dlang (subscriber, #313) [Link]

I can't talk about the 'large part of the customer base' part of this question, but I work in a large (8000+ person) company that runs thousands of servers and I see this mindset of "if it's not tagged as a security issue, we don't really need to apply it" continuously.

Far too many people have the opinion that change, _any_ change should be avoided and so they avoid doing any changes that aren't either tagged as security fixes or causing an outage.'s road to recovery

Posted Oct 13, 2011 8:23 UTC (Thu) by Klavs (guest, #10563) [Link]

Not to be annoying here - but fact remains, that upgrading to new versions of the kernel, also includes new features, which in turn may add more security problems, than the bugfixes solved.

There's a reason people pay RHEL to backport ONLY fixes (bugs, security etc.) - so the change becomes as little as possible - increasing the likelyhood of the amount of bugs with security impact going down, as time goes by and bugfixes are applied.

Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds