4 ms·
Include full quotes of relevant information - because context is important. The very next sentence following your quote: >More importantly, when we fix them,
by Nadya 11y ago
Include full quotes of relevant information - because context is important.
The very next sentence following your quote:
>More importantly, when we fix them, your vendor probably
won't have the fix for at least another week or two in most cases anyway.
... ...
>We'd basically be announcing a bug that (a) may not be relevant to you,
but (b) _if_ it is relevant to you, you almost certainly won't actually
have fixed packages until a week or two later available to you!
- jquast 11y agoWell I didn't want to reproduce the entire thread. The basic summary is Linus feels that labeling bugs as a security threat should not be pointed out as such, rather keep such information private, even though the fix is public. Because life is short. If you want security patches, find a vendor to help filter the bad bugs from the big bugs for you. In the meantime, hackers see the fix, recognize the security risk, and build exploits long before your vendors even recognize it as a potential security risk (probably only after it is exploited in the wild would they understand it as such). Good luck with that.
- geofft 11y agoMozilla is a vendor. Very few people get a Firefox rebuilt by a third party. (And, in fact, Mozilla takes steps to make that more cumbersome to do legally than just redistributing the upstream build.) Linux is relatively unusual among security-sensitive free-software products in neither being a vendor nor wanting to be a vendor.
- mccr8 11y agoI don't know what Linux does, but Mozilla puts out security advisories for every release. https://www.mozilla.org/en-US/security/advisories/ https://www.mozilla.org/en-US/security/advisories/