48
The Linux kernel is a CNA - so what?
(www.codethink.co.uk)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 17 May 2024
48 points (90.0% liked)
Linux
48691 readers
1225 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
Short version: A bunch of shitty companies have as business model to sell open databases to companies to track security vulnerabilities - at pretty much zero effort to themselves. So they've been bugging the kernel folks to start issuing CVEs and do impact analysis so they have more to sell - and the kernel folks just went "it is the kernel, everything is critical"
tl;dr: this is pretty much an elaborate "go fuck yourself" towards shady 'security' companies.
Apologies for my ignorance, but could you elaborate?
I'm sincerely not seeing the connection between saying everything is critical as a go fuck yourself towards those companies.
Is it a 'death by quantity' thing?
~Anti~ ~Commercial-AI~ ~license~ ~(CC~ ~BY-NC-SA~ ~4.0)~
Pretty much that - those companies rely on open projects to sort it for them, so they're pretty much scraping open databases, and selling good data they pull from there. That's why they were complaining about the kernel stuff - the info required was there already, just you needed to put effort in, so they were asking for CVEs. Now they got their CVEs - but to profit from it they'd still need to put the same effort in as they'd had to without CVEs in place.
Not really. This is mostly what this is all about. The companies are insisting that open source projects should do analysis of security impacts in addition to fixing the bugs whenever some "security researcher" runs some low effort fuzzing or static analysis thing that produces large numbers of bug reports and assigns CVEs to them without the consent of the project. The problem is that such an impact analysis is significant effort (often orders of magnitude more than the fix itself) by people with deep knowledge about the code bases and only really useful to the customers of those companies who want to selectively update instead of just applying all the latest fixes.
Yes and no. The short version is right, but it's not a GFY. If anything, device OEMs are going to be positively ecstatic that anyone who cares about these vulnerability trackers are going to have to buy a new device every five years.
I wasn't talking about OEMs - and companies who do somewhat care about vulnerabilities already have policies in place only allowing specific device vendors and specific OS versions. There might be a tiny bit more once that gets hooked into some automation, but probably pretty much negligible. If you have a 5 year old device and your vendor isn't patching it anymore getting rid of it is the right choice, with or without looking at specific vulnerabilities.