Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.devel.release > #80797

Re: Arch qualification for buster: call for DSA, Security, toolchain concerns

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Fri, 2018-06-29 at 22:33 +0100, Ben Hutchings wrote:
> On Fri, 2018-06-29 at 22:31 +0200, Moritz Mühlenhoff wrote:
> > Niels Thykier wrote:
> > > If the issues and concerns from you or your team are not up to date,
> > > then please follow up to this email (keeping debian-release@l.d.o and
> > > debian-ports@l.d.o in CC to ensure both parties are notified).
> > 
> > Two issues that we discussed at the recent Security Team sprint wrt
> > problems affecting buster:
> > 
> > (1) Linux upstream security support for i386 seems at risk at this point.
> > E.g. KPTI for i386 still isn't merged in Linux master half a year later after
> > the public Meltdown disclosure in early January (and the development of KPTI
> > started months before that). Someone at SuSE actually developed patches
> > as an older SLES release using Linux 3.0 (!) still supports i386, but that
> > will also EOL at some point and if we don't have the manpower to
> > develop upstream fixes for future i386-specific flaws.
> > 
> > It's not a strict blocker, but we wanted to raise the discussion whether
> > it still makes sense to ship 32 bit kernels for buster, which means with
> > support until ~ 2022.
[...]

Also, if there is a question about the continued use of 32-bit x86
systems, it appears that the AMD Geode LX and VIA C7 processors are
still commercially available.

(I'm ignoring the Intel Quark since it can't run a standard i386 user-
space.)

Ben.

-- 
Ben Hutchings
Sturgeon's Law: Ninety percent of everything is crap.

Back to linux.debian.devel.release | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Re: Arch qualification for buster: call for DSA, Security, toolchain  concerns Moritz Mühlenhoff <jmm@inutil.org> - 2018-06-29 22:40 +0200
  Re: Arch qualification for buster: call for DSA, Security,  toolchain concerns Ben Hutchings <ben@decadent.org.uk> - 2018-06-29 23:40 +0200
    Re: Arch qualification for buster: call for DSA, Security,  toolchain concerns Ben Hutchings <ben@decadent.org.uk> - 2018-06-30 00:10 +0200
    Re: Arch qualification for buster: call for DSA, Security, toolchain  concerns Moritz Mühlenhoff <jmm@inutil.org> - 2018-06-30 22:20 +0200
  Security support for go in buster (Was: Re: Arch qualification for  buster: call for DSA, Security, toolchain concerns) Niels Thykier <niels@thykier.net> - 2018-07-01 11:00 +0200
    Re: Security support for go in buster (Was: Re: Arch qualification  for buster: call for DSA, Security, toolchain concerns) Moritz Mühlenhoff <jmm@inutil.org> - 2018-07-01 22:10 +0200

csiph-web