3 ms·
> a notification should have gone out from the kernel team to a curated list of distro security folk Who would curate that list though? You don't need permissi
by steve1977 6mo ago
> a notification should have gone out from the kernel team to a curated list of distro security folk
Who would curate that list though? You don't need permission from the kernel team to spin up a new distro. I can go and create fork of Debian or Arch or whatever today and the kernel team would never know (and neither should they).
This is completely in the responsibility of the distros. If you don't like this model, use something like FreeBSD.
- mort96 6mo agoSounds like a job for the Linux Foundation maybe? You don't need anyone's permission to make a distro, that's true, but if you notify Debian, Canonical, Fedora, Red Hat and Arch you're covering a very large fraction of users; way more than today's 0%. In cases like this, perfect is the enemy of the good.
- dotancohen 6mo agoA rogue actor may create a new distro, maybe for some niche use case such as accessibility or retro gaming. After acquiring enough false (and even some real) users that the Linux Foundation accepts them as a notifiable distro maintainer, this maintainer could then pwn machines before the exploit is made public.
- danlitt 6mo agoRather than the current situation, where they can pwn machines after the exploit is made public?
- dotancohen 6mo agoYes. After the exploit is made public, the window of opportunity closes quickly.
- danlitt 6mo agoNot if people don't get notified!
- mort96 6mo agoI didn't say all distros should be notified, for that exact reason. I listed a handful of major fistros.
- steve1977 6mo agoWho gets to decide who the lucky few are?
- lillecarl 6mo agoHuman beings
- steve1977 6mo agoQualified by what?
- Dylan16807 6mo agoAre you implying it requires expertise to figure out the ten (plus or minus a factor of two) biggest distros? I think most people that understand the context of the question can figure out pretty similar lists.
- mort96 6mo agoSounds like a job for the Linux Foundation maybe?
- DarkUranium 6mo agoThe Linux Foundation hasn't been about Linux (except marginally) in a long while, if ever. The name is a misnomer.
- aragilar 6mo agoUh, there is a list, named "linux-distros", which is for this purpose (and I think it's for more than just Linux, e.g. I believe it was used for the xz vuln). Given this was announced when backports weren't ready (and given the POC was at least opaque if not obfuscated), I'm getting the vibe fixing the vuln wasn't as high as a priority as making a media splash.
- j16sdiz 6mo agoFrom TFA: > Note that for Linux kernel vulnerabilities, unless the reporter chooses > to bring it to the linux-distros ML, there is no heads-up to > distributions. so, no, `linux-distros` list don't solve the problem.
- jamespo 6mo agoThe impacted user count of your debian fork with custom compiled kernel would probably not be more than 1 however.