Linux security vulnerabilities fixed per kernel version
(midwest.social)
LinuxNot all CVEs are equal.
This is akin to increased testing and diagnostics for a disease, lots of false positives and negatives, plus many flagged instances which would otherwise be benign.
Increasing visibility is always preferable, but the spectrums of quantity and quality become broader and less consistent as it expands.
That’s a nice hot take. Got any data to back that up?
The one example I’m aware of is prostate cancer. Diagnosis went through the roof when better testing became available, but the majority of the increase wouldn’t have a meaningful impact on the patients life quality or longevity.
My interpretation of the graph from this post is it’s the initial volley of potential instances from a new diagnostic tool, literally the low-hanging fruit. It’s mildly useful and somewhat interesting, but as with anything constituted from statistics, it’s an incomplete picture.
Ah, well I certainly agree with the general notion you’ve stipulated. My question for data was regarding the quality of the CVEs, not the concept.
CVEs are allocated to any issue that gets flagged as a potential security issue; their severity is a subcategory, and their impact and relevance are wildly dependent on context and peripheral elements.
The language of Neptune is not for mere mortals, it seems Maybe using a different on might make sense aye?
I assume this is associated with AI. I do wonder if any of the recent CVEs are due to prior patches using AI code.
Those will be much harder to find and even harder to fix.
If there ends up being one, you can expect it to be of the type that one won't expect there to be in a kernel, so it would be hard to logically track it to the kernel in the first place.
I don't know necessarily if they will be harder to find, but I do know that compounding bad fixes to get harder to fix over time. I just think it would be interesting to see if the AI code is responsible for more CVEs in the long term or if it's just finding more things unrelated to those code changes.
I'm too normie for this graph, are the version roughly equal distance in time?
I don't think the chart has an element of time in it.
They didn't used to be, but now, yes.
The versions this graph starts from, are equidistant enough.
Should be, there's a new kernel release every 3 months or so I think
AI both finds and fixes the vulnerabilities and we're no better off
According to GKH, Linux's N°2, AI finds vulns but isn't good at fixing them.
