Here is a hopefully-useful notice about Linux kernel security issues, as it seems like this knowledge isn't distributed very widely based on the number of emails I get on a weekly basis:
- The kernel security team does not have any "early notice"
announcement list for security fixes for anyone, as that would only
make things more insecure for everyone.
- The kernel community does not assign CVEs, nor do we deal with them
at all. This is documented in the kernel's security policy, yet we
still have a number of people asking for CVE numbers even after
reading that policy. See my longer "CVEs are dead..." talk for full
details about how the CVE process is broken for projects like Linux:
kernel-recipes.org/en/2019/tal…
- You HAVE to take all of the stable/LTS releases in order to have a
secure and stable system. If you attempt to cherry-pick random
patches you will NOT fix all of the known, and unknown, problems,
but rather you will end up with a potentially more insecure system,
and one that contains known bugs. Reliance on an "enterprise"
distribution to provide this for your systems is up to you, discuss
it with them as to how they achieve this result as this is what you
are paying for. If you aren't paying for it, just use Debian, they
know what they are doing and track the stable kernels and have a
larger installed base than any other Linux distro. For embedded,
use Yocto, they track the stable releases, or keep your own
buildroot-based system up to date with the new releases.
- Test all stable/LTS releases on your workload and hardware before
putting the kernel into "production" as everyone runs a different %
of the kernel source code from everyone else (servers run about
1.5mil lines of code, embedded runs about 3.5mil lines of code, your
mileage will vary). If you can't test releases before moving them
into production, you might want to solve that problem first.
- A fix for a known bug is better than the potential of a fix causing a
future problem as future problems, when found, will be fixed then.
I think I need to give another talk about this issue to go into the above in more detail. So much for me giving a technical talk at Kernel Recipes this year...
Elena ``of Valhalla''
in reply to Elena ``of Valhalla'' • •TFW annunci “e adesso sto guidando su una strada larga e dritta” e 10 secondi dopo esci da una curva quasi cieca e vedi due pulman che stanno sorpassando una bicicletta e finisci a sfiorare la siepe a bordo strada con lo specchietto di sinistra per evitare di toccare il secondo pulman con lo specchietto di estra.
(Nessuno si è fatto male, né lo specchietto né il cespuglio, è stata una cosa tipo gatto che usa le vibrisse per controllare se ci passa da un pertugio :D )
Whiskey a gogo reshared this.
Elena ``of Valhalla''
Unknown parent • •@David de Groot it wasn't that bad: when I got out of the curve there was plenty of space for the first bus to finish overtaking, and thus plenty of space for me to react to the second bus who did the same when there *wasn't* plenty of space (because of course it would do that, they were probably traveling together, and my expectations were safely low :D ).
It was just proof that, while definitely *wider* and *straighter* than the road I had been driving just before, well, calling it *wide* and *straight* was still a bit of a stretch :D