Re: [gentoo-hardened] kernel no longer in hardened-development overlay?

[Mansour Moufid <mansourmoufid@gmail.com>]

On Mon, Apr 19, 2010 at 7:24 PM, Ed W <lists@wildgooses.com> wrote:
> Can we please avoid annoying the few developers we have working on hardened.

I didn't mean to come off as critiquing anyone. I am a fan of the
Gentoo Hardened and Security projects. I was only stating my
impressions.

> I would also disagree that there are some big vulnerabilities just because
> your "stable" kernel is older.  Personally I prefer to stay a little more up
> to date, but I think there are a good may Redhat and Centos servers running
> much older kernels than that...

I disagree. That is a dangerous assertion. It is no secret that most
vulnerabilities in Linux are fixed silently, without ever being
reported as such. Hence why older kernels are more vulnerable. As for
RedHat and CentOS:

   ``silently-fixing vulnerabilities
   has become standard operating procedure among the kernel developers,
   confusing even their own ranks as to what needs to be backported to
   distro kernels or the stable tree.''[1]

[1] <http://milw0rm.com/exploits/9191>

-- 
Mansour Moufid