Re: The state of linux security
Date: Wed Jul 16 2008 - 12:37:06 EST
On Wed, 16 Jul 2008, Cheradenine Zakalwe wrote:
If it turns out that the current development model has produced too
many security problems then the development model must change. I'd
like to think that the integrity of most peoples systems is more
important than some micro benchmark improvement because of some
complex scheduler change. That's not to say the latter isn't
important, just that more time and effort needs to be put into making
sure that the changes don't affect users in potentially disasterous
how can you tell for sure if a bug has security implications or not?
the argument can be made that just about any bug can be a security bug
frequently the security implications of a bug are not known at the time
it's fixed, but are discovered later. how do you expect to have this in
if you only upgrade when there is a 'security bug' announcement you will
miss a lot of important upgrades.
as Linus stated, there's nothing preventing anyone who thinks that he's
not doing an appropriate job from doing the research on the security
implications of everything and doing their own announcements or just
maintaining their own tree.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/