Messages in this thread |  | | Date | Sun, 5 Jan 2020 16:28:31 -0500 | From | "Theodore Y. Ts'o" <> | Subject | Re: Is the Linux kernel underfunded? Lack of quality and security? |
| |
On Sun, Jan 05, 2020 at 04:47:33AM +0100, Evan Rudford wrote: > The problem of underfunding plagues many open source projects. > I wonder whether the Linux kernel suffers from underfunding in > comparison to its global reach. > Although code reviews and technical discussions are working well, I > argue that the testing infrastructure of the kernel is lacking. > Severe bugs are discovered late, and they are discovered by developers > that should not be exposed to that amount of breakage. > Moreover, I feel that security issues do not receive enough resources.
It sounds like you are unaware of the Kernel Self Protection Project (KSPP), which is focused on proactively improving the kernel's security features, and the KernelCI project. There is quite a lot of work happening already.
One of the challenges is that is an extremely large number of different ways a kernel can be configured, and that a *very* large number of the bugs tend to be hardware specific. Running CI on all possible hardware that might run Linux is really not practical; but there is a very large number of tests being run on both VM's and on those hardware platforms that companies who are donating hardware to KernelCI care about.
Keep in mind that there is *always* the opportunity to do more testing and QA work. Companies which care about specific hardware and software configurations are contributing resources (both money and engineering headcount) to improve the quality for those specific configurations. So there is *always* opportunities where more resources can improve any product. This is true whether you are talking about, say, a $15,000 Ford Fiesta or a $115,000 Porsche 911.
If you have access to resources that you would like to contribute, and have some specific areas where you would like to see improvement, we can certainly put you in touch with the various organizations, such as the Linux Foundation, which are organizing efforts such as KernelCI. There are also a number of engineers from a goodly number of companies contributing to the Kernel Self Protection Project. If you are interested in getting involved, please see:
https://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project
Cheers,
- Ted
|  |