Re: The state of linux security

From: david
Date: Wed Jul 16 2008 - 12:37:06 EST

On Wed, 16 Jul 2008, Cheradenine Zakalwe wrote:

If it turns out that the current development model has produced too
many security problems then the development model must change. I'd
like to think that the integrity of most peoples systems is more
important than some micro benchmark improvement because of some
complex scheduler change. That's not to say the latter isn't
important, just that more time and effort needs to be put into making
sure that the changes don't affect users in potentially disasterous

how can you tell for sure if a bug has security implications or not?

the argument can be made that just about any bug can be a security bug

frequently the security implications of a bug are not known at the time it's fixed, but are discovered later. how do you expect to have this in the announcements?

if you only upgrade when there is a 'security bug' announcement you will miss a lot of important upgrades.

as Linus stated, there's nothing preventing anyone who thinks that he's not doing an appropriate job from doing the research on the security implications of everything and doing their own announcements or just maintaining their own tree.

David Lang
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at