Hacker News Reader

Comment by revelation | Hacker News Reader

Well Intel for one manufactures the insecure CPUs..

This will be merged for 4.16, when there is no 4.15 release yet. No idea what your cloud computing companies run but it's not 4.15-dirty, and backporting this monster is a great recipe for a nightly emergency when it goes OOPS.

edit: it isn't even merged yet.

View on HN

Like the backports here?

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...

Go test!

I agree, they're very scary. Also, watch out: a kernel with PTI on will not function in KVM-emulated secure boot mode until a KVM fix gets backported as well.

Some of these patches are already on stable marked kernels. In fact, I'm already running them. There was also an issue where some different default GCC flags hardened gentoo uses was causing the kernel to not be able to boot.

It is being backported to 4.14, and presumably earlier kernel too.

Yep. The kernel maintainers are being so aggressive with this that I'll be very concerned if there isn't a major security issue coming down the pipe. I know that Linux is considered fast and loose in various circles of old-school hackers, and granted, but merging this type of fundamental change into stable is not normal. There's something brewing here that is pushing this to completion.

Sure, with the appropriate baking time. But I don't see a cloud company taking an intermediate version of this patchset, backporting it themselves and then sending it out to all their customers in a hurry.

Why not? Isn't that what they should do in case of a kernel security issue?

Reply on news.ycombinator.com