4 ms·
> The vulnerability would be buried. Greg is extremely, consistently reluctant to issue CVEs without security engineers bending over backwards. From https://ke
by scottlamb 5y ago
> The vulnerability would be buried. Greg is extremely, consistently reluctant to issue CVEs without security engineers bending over backwards.
From https://kernel-recipes.org/en/2019/talks/cves-are-dead-long-live-the-cve/ https://kernel-recipes.org/en/2019/talks/cves-are-dead-long-... I'd paraphrase his philosophy as kernel developers should fix bugs (without requiring they be security-related or worrying about CVE assignment), users should run a recent stable/long-term kernel.
- staticassertion 5y agoLTS is a noble effort but leaves quite a lot to be desired, and doesn't really change the fact that Greg (and others) have multiple decades of history hiding vulns and pushing back on CVEs.
- gnubison 5y agoHave you watched the talk? Greg talks a lot about the flaws with CVEs.
- staticassertion 5y agoYes, I have.