Rich Johnson wrote:
On Saturday, October 4, 2003, at 12:24 AM, Jacob Anawalt wrote:Everytime I think about this thread or any boast about uptime one question comes into my mind:Are these machines on trusted networks with trusted users, or do people really get lucky and pick or compile a kernel that doesn't have any bugs/exploits found in the next year?At this point aren't most of the vulnerabilities found in the loadable modules and/or services rather than the kernel itself?
Wed, 13 Aug 2003 20:46:04 -0400 [SECURITY] [DSA-358-4] New kernel packages fix potential "oops" Tue, 5 Aug 2003 08:58:30 -0400 [SECURITY] [DSA-358-2] New kernel packages fix potential "oops" Mon, 4 Aug 2003 22:00:46 -0400 [SECURITY] [DSA-358-3] New kernel packages fix potential "oops" Thu, 31 Jul 2003 21:57:30 -0400 [SECURITY] [DSA-358-1] New kernel source and i386, alpha kernel images fix multiple vulnerabilities Sun, 29 Jun 2003 12:19:51 -0400 [SECURITY] [DSA-336-1] New Linux 2.2.20 packages and i386 kernel images fix several vulnerabilities Sat, 28 Jun 2003 21:44:01 -0400 [SECURITY] [DSA-332-1] New Linux 2.4.17 source code and MIPS kernel images fix several vulnerabilities Sun, 8 Jun 2003 21:26:02 -0400 [SECURITY] [DSA-311-1] New kernel packages fix several vulnerabilities Mon, 9 Jun 2003 23:42:32 -0400 [SECURITY] [DSA-312-1] New powerpc kernel fixes several vulnerabilities Thu, 3 Apr 2003 15:22:50 +0200 [SECURITY] [DSA 276-1] New Linux kernel packages (s390) fix local root exploit Thu, 27 Mar 2003 07:49:13 +0100 [SECURITY] [DSA 270-1] New Linux kernel packages (mips + mipsel) fix local root exploit
http://lists.debian.org/debian-security-announce/debian-security-announce-2003/threads.htmlI hadn't used Debian before this spring, and it looks like from the 2002 and 2001 archives there were practically no issues with the kernel back then. It seemed like I would get a fixed kernel from RH every three to six months.
A view from the low end of the spectrum is that I've had no kernel problems since I switched my now 8 year old PowerMac to linux 3-1/2 years ago. For the last 1-1/2 years I've been happy as a clam with 2.4.18. With linux the machine's been more reliable than the power grid.
Very nice.
Alas, it's only been 125 days since the machine was last powered down for transport.
Don't get me wrong, I think the high uptime is an impressive testiment of the quality of the kernel and other software running on the system, but it also indicates that the kernel is likely missing some security update. It's your call if the security fixes an issue that is pertinent to your situation or not.
-- Jacob