oss-sec mailing list archives
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
From: Yves-Alexis Perez <corsac () debian org>
Date: Fri, 21 Jun 2019 11:32:05 +0200
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Sat, 2019-06-15 at 17:57 +0200, Greg KH wrote:
On Sat, Jun 15, 2019 at 11:49:03AM -0400, Alex Gaynor wrote:I do not have a solution to this problem. I wanted to raise awareness of it, in the hope that it would start a discussion which might come to a solution.Why not just do a simple "you must upgrade to the latest version X to fix a bunch of bugs" type of announcement? No need to worry about crazy backports and cherry-picking, that always fails in the end.
I sympathize with this view, and I think we need to get better at updating, but I really think not all projects can be “safely” just updated to the latest version. End-users and IT admins still value stability and regressions is still a thing in a lot of cases. And once a regression is introduced, it's not always a short time before it's fixed upstream. And before reaching the end-user, some project latest versions might depend on a lot of “latest version” of other projects. In some case the dependency tree might involve large scale changes affecting the whole system. So sure, in some cases it makes sense to just update to latest versions, but I' m really not sure it's the general case. I'm not entirely satisfied by the situation either but I don't have a magic way to fix it. Regards, - -- Yves-Alexis -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAl0MpBUACgkQ3rYcyPpX RFv88gf+NZG3Q3Q0s8gmEbgS76y8umnGk6DR3dHgstPP1A2pnCBhDhauQbNX/UKZ pLvdSMJw1LrlbNhfGtuKjuF9HqefulWfO2ex2l0ljmXbLuG0qYzehgAGvFCkv142 mZZW+yMDAB/O6gaDtBxhaOfKeK1h+oVE9H4u3Nu+AmyL17CW2DVrVYoBWXxsR5C6 RFITOyR24nc+gkLvW1IsIWM8S/Jfe/cTHvXdALYLAKD8EwTTasy3k1d3e5bHp6HW j35ERngM+5fcxgVGbBNRQh5ANKsrIWjxqtqH1ndJV4hSfdZTmso/cyztQnL7LZoy XG8fn/neQ2/GNlXdzB99anO6JQLoAQ== =sAOD -----END PGP SIGNATURE-----
Current thread:
- Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Alex Gaynor (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Greg KH (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Yves-Alexis Perez (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Simon McVittie (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Moritz Muehlenhoff (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Ian Zimmerman (Jun 21)
- Re: Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Simon McVittie (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Yves-Alexis Perez (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Greg KH (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Yves-Alexis Perez (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Greg KH (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Alex Gaynor (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Bob Friesenhahn (Jun 15)