Kernel.org's road to recovery

Posted Oct 11, 2011 9:07 UTC (Tue) by mpr22 (subscriber, #60784)
In reply to: Kernel.org's road to recovery by PaXTeam
Parent article: Kernel.org's road to recovery

I have actually encountered people who should know better engaging in behaviours sufficiently similar to "security fixes only!", though not on Linux. In this case it was approximately "fixes for our known problems only, cherry-picked from the more recent patches so that we can play semantic games with the qualification authority to avoid requal", and they subsequently ran into a problem that had been fixed in the latest patch, which they had been sent. They were somewhat upset when they were told that they wouldn't get support unless they applied the patches properly.

So yes, these people exist, and what matters is not the detail metric "how large a portion of the general-public user base do they feed kernels to?", but the overall metric "how important is it that they not screw up?".

Kernel.org's road to recovery

Posted Oct 11, 2011 10:34 UTC (Tue) by PaXTeam (guest, #24616) [Link] (2 responses)

right and we're talking about linux here, so give it another try. like, show me poeple who work for companies/distros of any significance (in terms of user base) *and* live under this mistaken belief. otherwise you've got no argument. also, this software you mentioned, do its authors publish security errata? do they mark security fixes explictly? did you tell them that they must at once stop doing that because it'll cause unspeakable damage?

Kernel.org's road to recovery

Posted Oct 11, 2011 18:58 UTC (Tue) by dlang (guest, #313) [Link] (1 responses)

I can't talk about the 'large part of the customer base' part of this question, but I work in a large (8000+ person) company that runs thousands of servers and I see this mindset of "if it's not tagged as a security issue, we don't really need to apply it" continuously.

Far too many people have the opinion that change, _any_ change should be avoided and so they avoid doing any changes that aren't either tagged as security fixes or causing an outage.

Kernel.org's road to recovery

Posted Oct 13, 2011 8:23 UTC (Thu) by Klavs (guest, #10563) [Link]

Not to be annoying here - but fact remains, that upgrading to new versions of the kernel, also includes new features, which in turn may add more security problems, than the bugfixes solved.

There's a reason people pay RHEL to backport ONLY fixes (bugs, security etc.) - so the change becomes as little as possible - increasing the likelyhood of the amount of bugs with security impact going down, as time goes by and bugfixes are applied.