3 ms·
> People don't do kernel reviews themselves. They just use the official kernel, and when someone finds a bug (or spots otherwise bad code), they notify the comm
by taviso 5y ago
> People don't do kernel reviews themselves. They just use the official kernel, and when someone finds a bug (or spots otherwise bad code), they notify the community.
There's a big difference here. When a vulnerability is found in the Linux kernel, that doesn't mean that you were compromised.
If a build was found to be malicious, then you definitely were compromised and it's little solace that it was discovered after the fact. This is why package managers check the deb/rpm signature before installing the software, not after.
- eru 5y agoWell, you'd still check the signature, to make sure you have the same build that the debian repository has. This is just an additional check that the debian repository has sane builds. (If someone mucks around with the debian repositories but you aren't the target, you might or might not be under attack.)