• Cosmic Cleric@lemmy.world
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    1
    ·
    edit-2
    6 months ago

    and the kernel folks just went “it is the kernel, everything is critical”

    tl;dr: this is pretty much an elaborate “go fuck yourself” towards shady ‘security’ companies.

    Apologies for my ignorance, but could you elaborate?

    I’m sincerely not seeing the connection between saying everything is critical as a go fuck yourself towards those companies.

    Is it a ‘death by quantity’ thing?

    Anti Commercial-AI license (CC BY-NC-SA 4.0)

    • aard@kyu.de
      link
      fedilink
      arrow-up
      30
      ·
      6 months ago

      Is it a ‘death by quantity’ thing?

      Pretty much that - those companies rely on open projects to sort it for them, so they’re pretty much scraping open databases, and selling good data they pull from there. That’s why they were complaining about the kernel stuff - the info required was there already, just you needed to put effort in, so they were asking for CVEs. Now they got their CVEs - but to profit from it they’d still need to put the same effort in as they’d had to without CVEs in place.

      • taladar@sh.itjust.works
        link
        fedilink
        arrow-up
        14
        ·
        edit-2
        6 months ago

        the info required was there already, just you needed to put effort in

        Not really. This is mostly what this is all about. The companies are insisting that open source projects should do analysis of security impacts in addition to fixing the bugs whenever some “security researcher” runs some low effort fuzzing or static analysis thing that produces large numbers of bug reports and assigns CVEs to them without the consent of the project. The problem is that such an impact analysis is significant effort (often orders of magnitude more than the fix itself) by people with deep knowledge about the code bases and only really useful to the customers of those companies who want to selectively update instead of just applying all the latest fixes.