Bringing the Android kernel back to the mainline

Posted Nov 20, 2018 20:52 UTC (Tue) by pizza (subscriber, #46)
In reply to: Bringing the Android kernel back to the mainline by farnz
Parent article: Bringing the Android kernel back to the mainline

> When you say "very slowly", exactly how slowly do you mean? I've picked on OpenSSL because the security circus has been shouting about it for over a decade, and yet there's been three bugs with the same underlying engineering errors in that time that are significant enough to be mentioned in Wikipedia.

Quality engineering, especially on an ongoing basis, costs money.

How many of those "shouting" have actually contributed anything to OpenSSL other than hot air?

(And feel free to s/OpenSSL/any other critical infrastructure tool/)
(Yes, $big_players finally created/funded the Core Infrastructure Initiative, but it's a long uphill climb..)

Bringing the Android kernel back to the mainline

Posted Nov 21, 2018 11:04 UTC (Wed) by farnz (subscriber, #17727) [Link]

Not many - but the hot air is what the security circus brings, and worse, because the people making decisions often lack technical judgement (not their skillset), it encourages a tendency towards monoculture - better to be one of a million breached sites than to risk the security circus coming down on you for doing something different.