3 ms·

#1 is intentional, for better or for worse. It’s certainly well-intentioned too, although the intentions may be based on wrong assumptions. #2: upstream makes

by amluto 5y ago

#1 is intentional, for better or for worse. It’s certainly well-intentioned too, although the intentions may be based on wrong assumptions. #2: upstream makes no general effort to identify security bugs as such. Obviously this one was known to be a security bug, but the general policy (see #1) is to avoid announcing it. #3: In any embargo situation, if you’re not on the distribution list, you don’t get notified. This is unavoidable. oss-security nominally handles everyone else, but it’s very spotty. Sometimes I wish there was a Linux kernel security advisory process, but this would need funding or a dedicated volunteer.

rfoo 5y ago
TBH the thing annoyed me most in this story is the "Someone had to start the disclosure process on linux-distros again and if they didn't no one would know"-part. There are certainly silent bug fixes where the author intentionally (or not) does not post to linux-distros or any other maillists even after stable release. It would take an hour to dig a good example tho. (Okay, maybe 10 minutes if I'm going to read Brad Spengler's rants) I guess a Linux kernel security advisory process is needed to fix this, but yeah :(
- amluto 5y ago
  For what it’s worth, linux-distros has its own opinions that are not necessarily compatible with those of the upstream kernel.
mjw1007 5y ago
If only there was some kind of foundation with a revenue of $177 million last year which had an interest in Linux's success.
- nisa 5y ago
  they are busy doing blockchain projects :)
sirdarckcat 5y ago
> Sometimes I wish there was a Linux kernel security advisory process, but this would need funding or a dedicated volunteer. This is already happening https://osv.dev/list?q=Kernel&affected_only=true&page=1&ecosystem=Linux https://osv.dev/list?q=Kernel&affected_only=true&page=1&ecos...
- amluto 5y ago
  As far as I know, this doesn’t get information from upstream maintainers. For this to work well, I think we would want actual advisories generated around commit time, embargoed early notification, and a process for publication.

by amluto 5y ago

rfoo 5y ago

TBH the thing annoyed me most in this story is the "Someone had to start the disclosure process on linux-distros again and if they didn't no one would know"-part. There are certainly silent bug fixes where the author intentionally (or not) does not post to linux-distros or any other maillists even after stable release. It would take an hour to dig a good example tho. (Okay, maybe 10 minutes if I'm going to read Brad Spengler's rants) I guess a Linux kernel security advisory process is needed to fix this, but yeah :(

amluto 5y ago
For what it’s worth, linux-distros has its own opinions that are not necessarily compatible with those of the upstream kernel.

mjw1007 5y ago

If only there was some kind of foundation with a revenue of $177 million last year which had an interest in Linux's success.

nisa 5y ago
they are busy doing blockchain projects :)

sirdarckcat 5y ago

> Sometimes I wish there was a Linux kernel security advisory process, but this would need funding or a dedicated volunteer. This is already happening https://osv.dev/list?q=Kernel&affected_only=true&page=1&ecosystem=Linux https://osv.dev/list?q=Kernel&affected_only=true&page=1&ecos...

amluto 5y ago
As far as I know, this doesn’t get information from upstream maintainers. For this to work well, I think we would want actual advisories generated around commit time, embargoed early notification, and a process for publication.