@vbabka @llvm That is correct, the AMD entry is back in place, it was my fault, another company was claiming AMD said something that they didn't actually say in a "fun" email thread that I don't want to revisit anymore...

Check out @gregkh 's Mentorship Session: Demystifying the #Linux Kernel Security Process

https://youtu.be/sLX1ehWjIcw?si=obRx2vcNuZSjieWY

So I presented today on EU CRA, NIS2 and other initiatives to regulate code/hardware/services. One consistent piece of feedback I got is that the amount of upcoming regulation is so huge that even dedicated professionals are unable to keep track of it all. So it is not just me (or you). It is _a lot_. https://berthub.eu/one/EU%20and%20you.pdf

@somenxavier @embeddedrecipes As we have said for decades, "there is no roadmap, Linux is evolution, not intelligent design". Submit changes you want to see happen if you want change, that's what everyone does!

How to fix the TTY layer in Linux?
@gregkh explains at #er2023
https://git.sr.ht/~gregkh/presentation-tty/tree/9afefcf3171a02e5eee19639ec62456511902a56/item/tty.pdf

Slides and recording of @gregkh's great @KernelRecipes talk "#Linux #Kernel security demistified" are now online:

Slides: https://git.sr.ht/~gregkh/presentation-security/blob/3547183843399d693c35b502cf4a313e256d0dd8/security-stuff.pdf

Video: https://www.youtube.com/watch?v=xDHTn0auo2w&t=14975s (that's a section of the live stream) #LinuxKernel

@gregkh @KernelRecipes This catches so well how versioning documents feels like 😅

Slides for my @KernelRecipes talk from yesterday for "Linux Kernel security demistified" can be found here: https://git.sr.ht/~gregkh/presentation-security and the video will be probably online sometime "soon" for those that missed the live stream.

@davem_dokebi our godfather on stage for a sump up of netconf 2023 #kr2023

A sign of DisplayPort over USB-C (external display) working with the #mainline kernel on the recently launched #Fairphone 5!

This wouldn't have been possible without the great work done by all the people contributing to Linux and this SoC, especially the amazing people at Linaro!

#postmarketOS #Fairphone5 #LinuxMobile #kr2023 #KernelRecipes

@funkylab @KernelRecipes then read the lwn.net article instead: https://lwn.net/Articles/944300/ There's no lack of information about the CRA out there right now.

@gregkh on stage: Demystifying the Linux kernel security process #kr2023 - serious things coming...

@krzk @corbet @sjvn press releases will never be read by the people that actually need to know this anyway, so we aren't going to go down that path :)

@corbet @sjvn Send the emails my way, no one seems to ever actually want to talk to _me_ about these support dates for some odd reason...

So OSS Europe was an interesting experience, this year, in a way.

I did my usual talk, and started with the usual section on kernel releases. When talking about stable updates I tossed in a quick mention that six-year support from the stable team was being phased out — something I understood to be generally known for about the last year. Way at the end of the talk, as my last topic, I discussed at some length the stresses being felt by kernel maintainers.

@sjvn wrote an article about the talk (https://www.zdnet.com/article/long-term-support-for-linux-kernel-to-be-cut-as-maintainence-remains-under-strain/) and made a connection between the stable-policy change and the maintainer issue — something I had not done in the talk. It was a bit of a shift from what I said, but not a bad article overall.

Then the rest of the net filled up with other writers putting up articles that were clearly just cribbed from SJVN's piece — sometimes with credit, sometimes without. I'm getting emails about what a terrible idea this all is, as if I had anything to do with that decision or can somehow change it. I have, it seems, taken away everybody's six-year support, and they're not happy about it.

All because of a 30-second mention of a change that was made public something like a year ago. My 1.5 minutes of fame has given me a new appreciation for this old quote from Rusty Russell: "when a respected information source covers something where you have on-the-ground experience, the result is often to make you wonder how much fecal matter you've swallowed in areas outside your own expertise."

@zev @monsieuricon That was my fault, my scripts didn't like the long latency of attempting to send emails while going through the chunnel and so the lockfile expired and decided to spawn a bunch of retries to resend the emails.

I disabled that for the return trip, and all is now good, apologies for the multiple messages, this seems to happen to me every few years...

@alwayscurious @andreasdotorg @badger Linux is a great fit for safety critical code, as is proven in many many installations of it in those types of systems in the world today. It all depends on the infrastructure around it, which is the same for any other choice of software at this level.

@alwayscurious That is not what I am saying at all. You need to understand your usage model and know just exactly what portions of the kernel you are using and design your update schedule around that.

And be prepared to update/reboot at any point in time, after properly testing updates.

Companies using Linux in their "uptime-critical" products usually already know all of this and can handle it just fine. If not, then they are designed and supported wrong and that's a company problem, not a Linux problem.

@jakub Why do you need an ID before the bug is fixed?

Here is a hopefully-useful notice about Linux kernel security issues, as it seems like this knowledge isn't distributed very widely based on the number of emails I get on a weekly basis:

- The kernel security team does not have any "early notice"
announcement list for security fixes for anyone, as that would only
make things more insecure for everyone.

- The kernel community does not assign CVEs, nor do we deal with them
at all. This is documented in the kernel's security policy, yet we
still have a number of people asking for CVE numbers even after
reading that policy. See my longer "CVEs are dead..." talk for full
details about how the CVE process is broken for projects like Linux:
https://kernel-recipes.org/en/2019/talks/cves-are-dead-long-live-the-cve/

- You HAVE to take all of the stable/LTS releases in order to have a
secure and stable system. If you attempt to cherry-pick random
patches you will NOT fix all of the known, and unknown, problems,
but rather you will end up with a potentially more insecure system,
and one that contains known bugs. Reliance on an "enterprise"
distribution to provide this for your systems is up to you, discuss
it with them as to how they achieve this result as this is what you
are paying for. If you aren't paying for it, just use Debian, they
know what they are doing and track the stable kernels and have a
larger installed base than any other Linux distro. For embedded,
use Yocto, they track the stable releases, or keep your own
buildroot-based system up to date with the new releases.

- Test all stable/LTS releases on your workload and hardware before
putting the kernel into "production" as everyone runs a different %
of the kernel source code from everyone else (servers run about
1.5mil lines of code, embedded runs about 3.5mil lines of code, your
mileage will vary). If you can't test releases before moving them
into production, you might want to solve that problem first.

- A fix for a known bug is better than the potential of a fix causing a
future problem as future problems, when found, will be fixed then.

I think I need to give another talk about this issue to go into the above in more detail. So much for me giving a technical talk at Kernel Recipes this year...