3 ms·

The vulnerability would be buried. Greg is extremely, consistently reluctant to issue CVEs without security engineers bending over backwards.

• scottlamb 5y ago
  > The vulnerability would be buried. Greg is extremely, consistently reluctant to issue CVEs without security engineers bending over backwards. From https://kernel-recipes.org/en/2019/talks/cves-are-dead-long-live-the-cve/ https://kernel-recipes.org/en/2019/talks/cves-are-dead-long-... I'd paraphrase his philosophy as kernel developers should fix bugs (without requiring they be security-related or worrying about CVE assignment), users should run a recent stable/long-term kernel.
  • staticassertion 5y ago
    LTS is a noble effort but leaves quite a lot to be desired, and doesn't really change the fact that Greg (and others) have multiple decades of history hiding vulns and pushing back on CVEs.
    • gnubison 5y ago
      Have you watched the talk? Greg talks a lot about the flaws with CVEs.
      • staticassertion 5y ago
        Yes, I have.