Received-SPF: pass (google.com: domain of linux-kernel+bounces-69377-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Fri, 16 Feb 2024 22:51:16 +0100 (CET)
From: Jiri Kosina <jikos@kernel.org>
To: Theodore Ts'o <tytso@mit.edu>
cc: Josh Poimboeuf <jpoimboe@kernel.org>, 
    Greg Kroah-Hartman <gregkh@linuxfoundation.org>, corbet@lwn.net, 
    workflows@vger.kernel.org, linux-doc@vger.kernel.org, 
    linux-kernel@vger.kernel.org, security@kernel.org, linux@leemhuis.info, 
    Kees Cook <keescook@chromium.org>, 
    Konstantin Ryabitsev <konstantin@linuxfoundation.org>, 
    Krzysztof Kozlowski <krzk@kernel.org>, 
    Lukas Bulwahn <lukas.bulwahn@gmail.com>, Sasha Levin <sashal@kernel.org>, 
    Lee Jones <lee@kernel.org>
Subject: Re: [PATCH v4] Documentation: Document the Linux Kernel CVE
 process
In-Reply-To: <20240216214521.GC549270@mit.edu>
Message-ID: <nycvar.YFH.7.76.2402162247380.21798@cbobk.fhfr.pm>
References: <2024021500-laziness-grimace-ed80@gregkh> <20240216192625.o3q6m7cjgkwyfe4y@treble> <nycvar.YFH.7.76.2402162108370.21798@cbobk.fhfr.pm> <20240216214521.GC549270@mit.edu>
User-Agent: Alpine 2.21 (LSU 202 2017-01-01)
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII

On Fri, 16 Feb 2024, Theodore Ts'o wrote:

> My observation is that the old system has had pretty low-quality
> CVE's, and worse, overly inflated CVE Severity Scores, which has
> forced all people who are supporting distro and cloud serves which
> sell into the US Government market to have to do very fast releases to
> meet FedRAMP requirements.  At least once, I protested an overly
> inflated CVSS score as being completely b.s., at a particular
> enterprise distro bugzilla, and my opinion as the upstream developer
> was completely ignored.
> 
> So quite frankly, at least one enteprise distro hasn't impressed me

Sad to hear that, no matter which distro that was :), hoewer ... 

> with avoiding low quality CVE's and high CVSS scores, and so I'm quite
> willing to give the new system a chance.  (Especially since I've been
> told that the Linux Kernel CVE team isn't planning on issuing CVSS
> scores, which as far as I'm concerned, is *excellent* since my
> experience is that they are quite bogus, and quite arbitrary.)

.. how is this new process going to change anything in that respect? 

There will always be some entity assigning a CVSS score (apparently not 
the kernel.org/LTS group), and then odds are the situation you are 
describing will end up happening according exactly the same scenario, 
right?

I am still trying really hard to understand what exactly is the problem 
this whole effort is magically solving for everybody out there either 
using Linux, or producing something around/on-top-of Linux. And I still 
don't get it.

Thanks,

-- 
Jiri Kosina
SUSE Labs