undefined | Better HN

0 pointsWrtCdEvrydy4y ago0 comments

You totally can... contact the kernel maintainers, tell them you want them to review a merge for security and they can give you a go/no go. If they approve your merge, then it's the same effect as purposely compromising millions without compromising millions.

0 comments

incrudible4y ago

Again, that's not the same, because then they will look for problems. What you want to test is that they're looking for problems all the time, on every patch, without you telling them to do so.

If they don't, then that's the vulnerability in the process.

WrtCdEvrydyOP4y ago

> because then they will look for problems. What you want to test is that they're looking for problems all the time, on every patch, without you telling them to do so.

That's what they do every time.

darkwinx4y ago

Telling them in advance will potentially make them more alert for problem coming from specific source. It will introduce bias.

The best they can do is notify the maintainers after they got the result for their research and give the maintainers an easy way to recover from vulnerability they intentionally create.

j / k navigate · click thread line to collapse