4 ms·
As someone who has nowhere in the vicinity of 1% of the responsibility to insuring that a code base is clean and performs its intended function- who is reviewin
by S_A_P 6y ago
As someone who has nowhere in the vicinity of 1% of the responsibility to insuring that a code base is clean and performs its intended function- who is reviewing all these pull requests? It cant be Linus, right? How are the folks with PR privileges vetted?
Fully admitting to ignorance here, but to me it seems that this problem is way to big to prevent bad actors from participating. I would love to hear thoughts to the contrary.
- secondcoming 6y agoCheck out lkml.org It's done by email
- Polylactic_acid 6y agoThat doesn't really answer the question. How do we know all of the reviewers are uncompromised?
- unixhero 6y agoThey have caught naughty pull requests before. I guess it's a multiple eyes thing. Certainly better than closed source Windows 10 and OSX.
- j88439h84 6y ago> Certainly better than closed source Windows 10 and OSX. How can you tell?
- deleted 6y ago[deleted]
- elteto 6y agoBy looking at it, literally.
- Razengan 6y agoHow can you compare?
- xyproto 6y agoCan know for sure vs nobody knows. The comparison is clearly in favor of Linux.
- Razengan 6y ago> The comparison is clearly in favor of Linux. Magnitudes of more people use Windows and macOS than Linux* and they have yet to fail catastrophically. * not counting servers and embedded
- _-___________-_ 6y agoThere are far more devices running Linux in the world than Windows & macOS combined. That would seem to be a much more useful comparison than how many people own those devices. Parent post was updated to say "not counting servers and embedded", but dismissing smartphones -- literally the most popular type of personal computing device in the world -- this way seems to completely invalidate the point.
- j88439h84 6y agoI dunno, why do you say that?
- _-___________-_ 6y agoThe parent thread was about possible backdoors; more devices running a piece of software = more surface area for any possible backdoor in that software.
- speedgoose 6y agoThe windows source code is actually readable for very large organizations and governments.
- throwaway_pdp09 6y agoI recall one famous one of quite a few years ago which looked suspiciously backdoor-ish (= instead of == IIRC), but can you provide a link to more?
- RinTohsaka 6y agohttps://news.ycombinator.com/item?id=24106213 https://news.ycombinator.com/item?id=24106213
- Razengan 6y agoOne could imagine a sophisticated attack involving multiple patches to different subsystems at different times, that eventually converge into a Voltron-like monster once they’re all inside the kernel.
- Fredej 6y agoPotentially. However that also leaves a larger attack-surface, in the sense that more patches = even more scrutiny. Conceivably such a scheme would require all parts to be included (I mean, why make it larger than necessary?), so it would be extremely fragile to any single maintainer seeing the potential for abuse and correcting it.
- nurettin 6y agoThis is called a chain of trust. You assume an unhealthy amount of tinfoil when someone suggests full chain compromise and move on with your life.
- fintler 6y agoThere's sorta like a "tree" of maintainers for each part of Linux -- with Linus at the top of the tree. When you make a patch for the kernel, there's a script you can run on the patch: scripts/get_maintainer.pl It'll output the appropriate subtree of maintainers who "own" the code in the kernel that the patch applies to. Then, you can email your patch to them. The maintainer will send the patch up the "tree" until (hopefully) it ends up in Linus' repo.
- Razengan 6y agoWhat happens after Linus dies? Could there be an schism between opposing successors?
- hpaavola 6y agoTwo years ago Linus took a break and Greg Kroah-Hartman was leading the project during that. Greg normally maintains the LTS branch of the kernel (and possibly many other things also).
- Bobbcatt 6y agoIt could. But like any floss projects, anybody can fork at anytime. If people have different visions they can either settle the difference or fork.
- drmpeg 6y agoThere are maintainers for each subsystem. For example, linux/drivers/media is maintained by Mauro Carvalho Chehab. When you have a patch, you submit it to the linux-media mailing list and it's vetted there. If Mauro thinks it's good, then he'll submit it to Linus as part of a large merge package. For the two patches I submitted, it took two months to get in the kernel.
- praveen9920 6y agoHere's the deal. For all practical purposes, Linux kernel code is maintained by sub-system maintainers, linus is just a stamp-head who merges everything provided by these guys and resolve conflicts, if there any. These guys are veterans in maintaining the sub-systems and make sure code base is clean enough based on linus' guidelines.
- linuxhansl 6y agoI got a small change into 5.8, and it was very carefully reviewed... Would be difficult to get anything bad, wrong, or malicious in. The maintainers are organized like a tree, Linus never saw my tiny change (I assume) but the maintainer reviewed it carefully.
- drybjed 6y agoYou can watch GregKH presentation[1] on the whole Linux kernel development process. [1]: https://www.youtube.com/watch?v=vyenmLqJQjs https://www.youtube.com/watch?v=vyenmLqJQjs
- Bobbcatt 6y agoIt's a tree with people near the top being all experienced devs. It's actually quite amazing how the whole thing works to produce high quality software.