Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Brite
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (Cyborg)
  • No Skin
Collapse
Brand Logo

CIRCLE WITH A DOT

gregkh@social.kernel.orgG

gregkh@social.kernel.org

@gregkh@social.kernel.org
About
Posts
14
Topics
0
Shares
0
Groups
0
Followers
0
Following
0

View Original

Posts

Recent Best Controversial

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @uecker @icing As is pointed, out, this is just a troll, but seriously, "worthy" isn't the issue. Again, you can not have one group "in" and one "out" without real reasons why anyone is "out".

    And again, my point remains, "All early release lists leak like a sieve, otherwise why does your government allow it to exist."
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @uecker @icing There are many reasons why this would not work. Again, step through the logic to prove it yourself.
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @uecker @icing @joshbressers @wdormann @Viss Why is it unconvincing? Who decides what group is on,or is not on, such a list? Your government? My governments? Their government? No government? Me? You? Someone else? And what is the criteria exactly for how?

    See how it breaks down when it hits the real world?

    As I have said many times, "All early-announce lists are a leak, otherwise why would your government allow it to exist?"
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @corsac @joshbressers @wdormann @Viss Linux makes it very "easy", just update your kernel to the newest version. What's preventing that from happening for your systems?
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @uecker @icing @joshbressers @wdormann @Viss There was no "embargo time". And again, Linux does not notify anyone because if we did, we would have to notify everyone.

    It's as if no one reads my long posts about this topic explaining it all...
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @zmanion @joshbressers @wdormann @Viss Why is linux-distros somehow "special" enough to get these types of announcements and not everyone else? How exactly would you explain that to your favorite government entity?
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @penguin42 @deftpunk @joshbressers @wdormann @Viss I honestly don't remember, and if I did, we don't publish who asked for CVE ids from us as that's generally not a good idea to do so (and is not a requirement for being a CNA).
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @joshbressers @deftpunk @wdormann @Viss the "announcement of a public web site and exploit" was not sent to the kernel security team. If you look at the timeline they published, they show what they sent the kernel security team and when, which seems to be correct to me.
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @joshbressers @wdormann @deftpunk @Viss What do you mean, they told us, we fixed it, it got in some stable kernels, and so our work on the security team was done. The CVE team assigned a CVE after a while, and even gave it a CVSS score.

    The fact that no distro popped up that used older kernel versions to do the real work to backport to older kernels seems to be everyone's major problem here. That is outside of the kernel security team's work entirely. So take it up with the distros that people are paying support for to do this for them?

    And yes, Debian was vulnerable, that is not good, and once it was noticed people worked hard and quickly to fix that. Not bad for a community-based distro that no one pays for in my opinion.
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @joshbressers @deftpunk @wdormann @Viss Loads of them.
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @wdormann @joshbressers @deftpunk @Viss Not ALL of the distros are on linux-distros. So that is one thing. The other being that I don't care what happens on linux-distros, for many public reasons I refuse to deal with them anymore, and strongly encourage no one else to do so either.
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @joshbressers @deftpunk @wdormann @Viss Honestly, there was nothing "obvious" about this one being a "big one" compared to all of the bugs we get, and fix, on a daily/weekly basis in the kernel.

    The ONLY thing different here from those bugfixes, was that someone made a web site, a simple reproducer, and announced it to the world. For 99.9% of the bugs we fix, that are reproducible like this, no one ever does that. That we know of...

    In other words, this was just another Tuesday for us.
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @deftpunk @joshbressers @wdormann @Viss no one did contact the kernel security team before they announced this. It was nice enough that they sent us a bug report and we got it fixed and pushed out to the latest stable kernel releases. That's all I can ever hope for.
    Uncategorized

  • So CopyFail CVE-2026-31431 is a thing.
    gregkh@social.kernel.orgG gregkh@social.kernel.org
    @wdormann @joshbressers @Viss I love it how people think that "coordination of vulnerabilities" is actually something that can be done these days. Think of just who uses the software in question, and who should, and should not, be on such a list to get a "early disclosure notification".

    As I have said for quite some time now, all early-disclosure lists are leaks, otherwise why would your government allow them to be in existence?

    Software, and specifically open source software, runs the world. So should the whole world be on that notification list? 🙂
    Uncategorized
  • Login

  • Login or register to search.
  • First post
    Last post
0
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups