3 ms·
There's a slight problem with the "google the problem, find a patch and apply it": if you can't read and understand the patch, you're in no better (and probably
by m_eiman 17y ago
There's a slight problem with the "google the problem, find a patch and apply it": if you can't read and understand the patch, you're in no better (and probably worse) shape than you were before, security-wise.
In some ways having a late patch from a trusted source is better than a quick one from some random place on the net. The best would be quick, trusted patches, of course. A GPG-style web of trust validation of patches, maybe?
- gmartres 17y agoTypically, the guy who found the flaw and fixed it will submit it to the upstream developers which hopefully will be able to tell if the patch can be trusted or not, apply it to the development repository, eventually release a patched version, and warn vendors(mostly, Linux distributions) to upgrade. The user only has to keep up to date.
- m_eiman 17y agoSure, but then you're back to having to wait for the vendor to supply a patch.
- m_eiman 17y agoSo you're (you being the who downvoted my comment) saying that you're NOT waiting for a vendor to approve and distribute a patch if it's been propesed by an outside developer? Please elaborate.