oss-sec mailing list archives
Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz
From: Greg KH <greg () kroah com>
Date: Fri, 21 Jun 2019 11:53:00 +0200
On Fri, Jun 21, 2019 at 11:32:05AM +0200, Yves-Alexis Perez wrote:
On Sat, 2019-06-15 at 17:57 +0200, Greg KH wrote:On Sat, Jun 15, 2019 at 11:49:03AM -0400, Alex Gaynor wrote:I do not have a solution to this problem. I wanted to raise awareness of it, in the hope that it would start a discussion which might come to a solution.Why not just do a simple "you must upgrade to the latest version X to fix a bunch of bugs" type of announcement? No need to worry about crazy backports and cherry-picking, that always fails in the end.I sympathize with this view, and I think we need to get better at updating, but I really think not all projects can be “safely” just updated to the latest version. End-users and IT admins still value stability and regressions is still a thing in a lot of cases. And once a regression is introduced, it's not always a short time before it's fixed upstream.
So it's a matter of "do I live with all of the bugs that everyone else knows about and how to exploit, or do I live with a potential regression?" That sounds like an easy choice given that the reason you should be updating is to resolve all of those known bugs :) Regressions always happen, we are human, but there are ways to mitigate them (testing, roll-back, preventing developers from not breaking things on purpose, etc.) And projects that do not do this type of work to prevent regressions need to learn that they should change, or users will go elsewhere. thanks, greg k-h
Current thread:
- Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Alex Gaynor (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Greg KH (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Yves-Alexis Perez (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Simon McVittie (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Moritz Muehlenhoff (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Ian Zimmerman (Jun 21)
- Re: Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Simon McVittie (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Yves-Alexis Perez (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Greg KH (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Yves-Alexis Perez (Jun 21)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Greg KH (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Alex Gaynor (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Bob Friesenhahn (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz David A. Wheeler (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Alan Coopersmith (Jun 15)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Bob Friesenhahn (Jun 16)
- Re: Thousands of vulnerabilities, almost no CVEs: OSS-Fuzz Solar Designer (Jun 16)