Kernel.org's road to recovery

Posted Oct 11, 2011 18:58 UTC (Tue) by dlang (guest, #313)
In reply to: Kernel.org's road to recovery by PaXTeam
Parent article: Kernel.org's road to recovery

I can't talk about the 'large part of the customer base' part of this question, but I work in a large (8000+ person) company that runs thousands of servers and I see this mindset of "if it's not tagged as a security issue, we don't really need to apply it" continuously.

Far too many people have the opinion that change, _any_ change should be avoided and so they avoid doing any changes that aren't either tagged as security fixes or causing an outage.

to post comments

Kernel.org's road to recovery

Posted Oct 13, 2011 8:23 UTC (Thu) by Klavs (guest, #10563) [Link]

Not to be annoying here - but fact remains, that upgrading to new versions of the kernel, also includes new features, which in turn may add more security problems, than the bugfixes solved.

There's a reason people pay RHEL to backport ONLY fixes (bugs, security etc.) - so the change becomes as little as possible - increasing the likelyhood of the amount of bugs with security impact going down, as time goes by and bugfixes are applied.