Re: Release of 2.4.21

Florian Weimer
2003-03-20T21:37:15Z

Jeff Garzik <jgarzik@pobox.com> writes:

> On Thu, Mar 20, 2003 at 09:43:01PM +0100, Florian Weimer wrote:
>> Releasing an official 2.4.21 with some fixes (and no new features) is
>> just a PR issue. I've already seen people comparing the alleged IIS
>> bug (or this new IE hole) and the ptrace() bug...
>
> Comparing, how? There is no comparison.

You know it, I know it, our readers know it. But the press puts them
on the same level nevertheless.

> This specific ptrace hole is closed, yay. Now what about the other
> 10,001 that still exist? People are blowing this ptrace bug WAY
> out of proportion.

I agree completely. Local security on traditional UNIX-like systems
is *so* poor that this bug doesn't really matter. No admin of a sane
mind lets untrusted users access important systems.

> The only reason why it demands a modicum of vendor responsibility is
> that a-holes are making easy-to-use exploits available for the
> script kiddies.

No, you miss a point. These exploits are important to keep you kernel
developers honest. Otherwise, you would have fixed this quitely, like
a couple of other bugs. Admins would assume that kernels offered a
decent level of local security, which can lead to very questionable
decisions.