1 |
* Matthew Thode schrieb am 03.09.15 um 21:46 Uhr: |
2 |
> On 09/03/2015 02:28 PM, Marc Schiffbauer wrote: |
3 |
> > * Anthony G. Basile schrieb am 02.09.15 um 18:13 Uhr: |
4 |
> >> Hi everyone, |
5 |
> >> |
6 |
> >> So by now most people have heard the news that the Grsecurity/PaX team |
7 |
> >> are no longer going to be making their stable patches available. The |
8 |
> >> reason is that they are in dispute with a certain embedded systems |
9 |
> >> vendor and those negotiations broke down. So they decided to make their |
10 |
> >> stable patches only available to the sponsors. [1] |
11 |
> >> |
12 |
> >> What does this mean for Gentoo? Up until now I have been maintaining |
13 |
> >> both the grsec upstream stable and testing patchsets in our |
14 |
> >> hardened-sources. Currently the upstream stable kernels are 3.2.71 and |
15 |
> >> 3.14.51 and the testing are 4.1.6. In about one week, the 3.2.71 and |
16 |
> >> 3.14.51 patchsets will no longer be available and I'll continue pushing |
17 |
> >> out the 4.1.6. Unfortunately the testing patchset is precisely as the |
18 |
> >> name suggests --- for testing and not production. For the embedded |
19 |
> >> systems company this will be the kiss of death because those patches are |
20 |
> >> not suitable for long term. For Gentoo it will mean that I will have to |
21 |
> >> be more vigilant about bugs and trying to stick with a well known kernel |
22 |
> >> before moving on. You can still use these kernels in production, but |
23 |
> >> you must be carefull about instabilities as upstream pushes out |
24 |
> >> experimental feature that may oops or panic. Keep older kernel images |
25 |
> >> around and revert if it doesn't work. Look to this list for |
26 |
> >> announcements about more serious issues like things that can cause data |
27 |
> >> loss. |
28 |
> >> |
29 |
> >> I'm hoping that once this company feels the sting of what has just |
30 |
> >> happened, they'll come back to the table and talk with Grsec/PaX people. |
31 |
> >> They won't be able to ship boards with grsec anymore because its not so |
32 |
> >> easy to switch out a kernel on a board! If they ship a board with a |
33 |
> >> bug, they loose. We just reboot :) |
34 |
> >> |
35 |
> >> [1] https://grsecurity.net/ |
36 |
> > |
37 |
> > Can't Gentoo be a sponsor? I think we could easly croudfund a |
38 |
> > sponsorship. |
39 |
> > |
40 |
> > This would help Gentoo and Grsecurty/PaX but OTOH that vendor might just |
41 |
> > use the gentoo kernel if they not already did so. |
42 |
> > |
43 |
> > Thoughts? |
44 |
> > |
45 |
> We can't do that because it would make the LTS patches public, which |
46 |
> spender is trying to avoid. |
47 |
|
48 |
True and what I wanted to say with the OTOH part. But doesn't this apply |
49 |
to any sponsor? I mean we are talking about GPL'ed Software... does the |
50 |
GPL permit to distribute source under some kind of NDA? |
51 |
|
52 |
I fully respect their decision but I hope things will be back to normal |
53 |
again soon. |
54 |
|
55 |
-Marc |
56 |
|
57 |
> |
58 |
|
59 |
|
60 |
|
61 |
-- |
62 |
0x35A64134 - 8AAC 5F46 83B4 DB70 8317 |
63 |
3723 296C 6CCA 35A6 4134 |