3 ms·
Well I didn't want to reproduce the entire thread. The basic summary is Linus feels that labeling bugs as a security threat should not be pointed out as such, r
by jquast 11y ago
Well I didn't want to reproduce the entire thread. The basic summary is Linus feels that labeling bugs as a security threat should not be pointed out as such, rather keep such information private, even though the fix is public.
Because life is short. If you want security patches, find a vendor to help filter the bad bugs from the big bugs for you.
In the meantime, hackers see the fix, recognize the security risk, and build exploits long before your vendors even recognize it as a potential security risk (probably only after it is exploited in the wild would they understand it as such). Good luck with that.
- geofft 11y agoMozilla is a vendor. Very few people get a Firefox rebuilt by a third party. (And, in fact, Mozilla takes steps to make that more cumbersome to do legally than just redistributing the upstream build.) Linux is relatively unusual among security-sensitive free-software products in neither being a vendor nor wanting to be a vendor.
- mccr8 11y agoI don't know what Linux does, but Mozilla puts out security advisories for every release. https://www.mozilla.org/en-US/security/advisories/ https://www.mozilla.org/en-US/security/advisories/