5 ms·
> So when I see an upstream gatekeeper accusing someone of not understanding what they are proposing, I am skeptical. Your comment reads like a textbook exampl
by rewmie 3y ago
> So when I see an upstream gatekeeper accusing someone of not understanding what they are proposing, I am skeptical.
Your comment reads like a textbook example of an appeal to authority.
Google engineers don't walk over water, and what Google accepts in their internal networks considering on Google's tightly locked internal security infrastructure might not map to real world security environments.
It also boggles the mind how you somehow presume a Linux kernel maintainer who repeatedly pointed out the failures of the proposed patch does not know what he is talking about. Unbelievable.
> The thing that is “dead on arrival” here is probably the ability of the general public to enjoy something that google already uses.
I'd wager that what the general public enjoys is working code with an excellent security track record thanks to the outstanding work by Linux kernel maintainers, who repeatedly stop broken submissions from being accepted.
- jeffbee 3y ago> working code with an excellent security track record It seems we are talking about different projects.
- rewmie 3y ago> It seems we are talking about different projects. Please point out a operating system that you feel has a better security track record than Linux.
- medler 3y agoPretty much any other Unix-like operating system. FreeBSD for example
- rewmie 3y agoSo far in 2023 all CVEs reported on Linux had at most a CVE score of 0-1, which is also the score of all CVEs reported for FreeBSD. https://www.cvedetails.com/cvss-score-charts.php?product_id=47&fromform=1 https://www.cvedetails.com/cvss-score-charts.php?product_id=... What exactly is your definition of security track record? Do you have any, or are you parroting cliches?
- Veserv 3y agoAlmost every vulnerability listed on that site since mid-July 2022 has what is effectively a NULL score which is the starting time of your query. The first Linux CVE I clicked at random has CVSS 0.0: https://www.cvedetails.com/cve/CVE-2022-4095/ https://www.cvedetails.com/cve/CVE-2022-4095/ The same CVE on the official NVD has CVSS 7.8: https://nvd.nist.gov/vuln/detail/CVE-2022-4095 https://nvd.nist.gov/vuln/detail/CVE-2022-4095
- medler 3y agoOk but if you look over the past 5 years or so, Linux has had 10x as many CVEs per year, including far more with high CVE scores.
- hollerith 3y agoI don't doubt it. I also heard that when a Linux dev find a bug that might be a vulnerability, they often don't bother adding it to the CVE database (and say as much in discussions with the other kernel devs) which casts doubt on the usefulness of counting CVEs as a way to estimate how secure Linux is.