Re: [stable] Linux 2.6.25.10

[pageexec@freemail.hu]

On 16 Jul 2008 at 3:08, David Miller wrote:

> From: pageexec@freemail.hu
> Date: Wed, 16 Jul 2008 11:49:45 +0200
> 
> > why? what makes you think that a bug fixed in 2.6.26 is not relevant to
> > 2.6.20? do you or anyone else personally verify that? color me impressed
> > if you do that on every single fix you commit.
> 
> Many people who do kernel development do exactly this for the vendor
> they work for.

i know that. but you conveniently skipped what i was replying to, here
it is for proper context:

> IOW, when we fix security issues, it's simply not even appropriate or 
> relevant to you.

i'll ask again: why aren't security fixes that you fix relevant to users
of older kernels (as that's what the topic was)? in other words, Linus was
trying to justify with one more silly reason why security fixe aren't marked
as such. the above basically said 'because they are not relevant to you'
and i asked him why it is so. you're welcome to explain it as well. and no,
vendors having people go through every single commit doesn't answer why you
couldn't make *their* life easier as well by not withholding information.
and not to mentiond a whole world of interested users beyond the commercial
companies that can afford this kind of cost.

> The SCTP socket option overflow fix got into various dist releases not
> by chance and not because of some utterly pointless "security" tag in
> the commit message.

why do you call a security tag 'utterly pointless'? i've heard Linus's
opinion and deconstructed every single one of his 'justifications' so far.
what's yours gonna be?

cheers,
  PaX Team