[gentoo-hardened] Re: kernel no longer in hardened-development overlay?

[Kerin Millar <kerframil@gmail.com>]

On 20/04/2010 00:43, Mansour Moufid wrote:
> On Mon, Apr 19, 2010 at 7:24 PM, Ed W<lists@wildgooses.com>  wrote:
>> Can we please avoid annoying the few developers we have working on hardened.
>
> I didn't mean to come off as critiquing anyone. I am a fan of the
> Gentoo Hardened and Security projects. I was only stating my
> impressions.
>
>> I would also disagree that there are some big vulnerabilities just because
>> your "stable" kernel is older.  Personally I prefer to stay a little more up
>> to date, but I think there are a good may Redhat and Centos servers running
>> much older kernels than that...

Except that they don't use vanilla kernels and invest considerable 
resources into the process of continually backporting fixes into their 
respective patchsets, both security related and otherwise. RHEL has a 
7-year life cycle during which introducing any potentially breaking 
changes in the kernel (or changes that may have an adverse impact on 
userspace) is simply out of the question.

>
> I disagree. That is a dangerous assertion. It is no secret that most
> vulnerabilities in Linux are fixed silently, without ever being
> reported as such. Hence why older kernels are more vulnerable. As for
> RedHat and CentOS:

Indeed. I believe that we'll be seeing a GLSA in the not-too-distant 
future which settles this argument beyond any doubt.

Cheers,

--Kerin