On Thu, 24 Apr 2003 06:39:50 BST, viro@parcelfarce.linux.theplanet.co.uk said:
> Excuse me, but I don't get the last part. You know that
> F had been built in environment of unspecified degree of security
> from source that had been kept in <--->
> written by programmers you don't know
> who had been hired in conformace with criteria <--->
> and released after passing QA of unknown quality (but you can bet
> that they had missed some security holes in the past)
> under a license that almost certainly disclaims any responsibility.
>
> Care to explain how does one get from the trust in above to "trusted to run"?
On top of which, if a buffer overflow is found, the exploit will run in
the context of the signed program. What it *does* mean is that once the
ankle-biting script kiddie breaks in, the kernel will hopefully refuse to
run their unsigned exploits.
--==_Exmh_695431504P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001
iD8DBQE+p3yYcC3lWbTT17ARAmRqAJ0aaN8xjzdZGDzPJzJvfkvSzurq+QCg2Vao
GMeoAbMQygYKsozR3Cn5K7A=
=zLPd
-----END PGP SIGNATURE-----
--==_Exmh_695431504P--
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/