4 ms·

(Honest, naïve question, I lack awareness of the Linux versioning scheme) Isn't Linux way into 5.x land for quite some time? Is the testing of 4.20-rc2 some kin

by lloeki 6y ago

(Honest, naïve question, I lack awareness of the Linux versioning scheme) Isn't Linux way into 5.x land for quite some time? Is the testing of 4.20-rc2 some kind of proxy to test there were no backports of the very latest mainline? ---- Researchers said they tested USBFuzz on: 9 recent versions of the Linux kernel: v4.14.81, v4.15,v4.16, v4.17, v4.18.19, v4.19, v4.19.1, v4.19.2, and v4.20-rc2 (the latest version at the time of evaluation) FreeBSD 12 (the latest release) MacOS 10.15 Catalina (the latest release) Windows (both version 8 and 10, with most recent security updates installed)

cmeacham98 6y ago
The linux kernel has several LTS releases for people who want to stay on the same version for stability reasons but also need security updates. I suspect from a security perspective testing whatever the latest 4.19.X version is would be roughly equivalent to 5.X. (Except, perhaps, for any USB-related features introduced in 5.X)
codys 6y ago
Since v3.0, Linux has treated the first _2_ numbers of it's version as something that is incremented sequentially (in the v2.6 era, the _3_rd number was used, prior to v2.6 there was a even/odd stable/unstable split) For example, we have normal releases v4.19 then v4.20 then v5.0 then v5.1. There will never be a v4.21. Stable releases use the third number. v4.14.81 is a stable release of v4.14.0. So the v4.20-rc2 statement just dates the work: $ git show v4.20-rc2 tag v4.20-rc2 Tagger: Linus Torvalds <torvalds@linux-foundation.org> Date: Sun Nov 11 17:12:54 2018 -0600
- gpm 6y ago
  Woah, so they did this a year and a half ago despite releasing this year (note that the paper has a 2020 reference in it). Weird! I guess responsible disclosure timelines on this sort of work must really suck.
  - 0xffff2 6y ago
    I don't know about computer security, but I've published peer reviewed research papers in other fields and a year and a half from data collection to publication doesn't seem unusual to me. If anything it's pretty fast.

by lloeki 6y ago

cmeacham98 6y ago

The linux kernel has several LTS releases for people who want to stay on the same version for stability reasons but also need security updates. I suspect from a security perspective testing whatever the latest 4.19.X version is would be roughly equivalent to 5.X. (Except, perhaps, for any USB-related features introduced in 5.X)

codys 6y ago

Since v3.0, Linux has treated the first _2_ numbers of it's version as something that is incremented sequentially (in the v2.6 era, the _3_rd number was used, prior to v2.6 there was a even/odd stable/unstable split) For example, we have normal releases v4.19 then v4.20 then v5.0 then v5.1. There will never be a v4.21. Stable releases use the third number. v4.14.81 is a stable release of v4.14.0. So the v4.20-rc2 statement just dates the work: $ git show v4.20-rc2 tag v4.20-rc2 Tagger: Linus Torvalds <torvalds@linux-foundation.org> Date: Sun Nov 11 17:12:54 2018 -0600

gpm 6y ago
Woah, so they did this a year and a half ago despite releasing this year (note that the paper has a 2020 reference in it). Weird! I guess responsible disclosure timelines on this sort of work must really suck.
- 0xffff2 6y ago
  I don't know about computer security, but I've published peer reviewed research papers in other fields and a year and a half from data collection to publication doesn't seem unusual to me. If anything it's pretty fast.