On 7/20/07, <a href="mailto:pageexec@freemail.hu">pageexec@freemail.hu</a> <<a href="mailto:pageexec@freemail.hu">pageexec@freemail.hu</a>> wrote:<br><br>> On 13 Jul 2007 at 0:43, Mike Perry wrote:<br><br>> > Is there any strategy behind the current efforts to support
<br>> > particular kernel versions?<br><br>> "it is less work to keep track of development changes"<br><br>> > I would think that most grsecurity users would want both<br>> > security and stability on their production systems.
<br><br>> we said it before, but here it is again: don't use 2.6 in such<br>> cases [...]<br>> you already decided to trade security for features/etc and<br>> discussion of which 2.6.x to track for stability and security
<br>> misses the point.<br><br>Honestly, I am not a skilled programmer. So I could not offer my<br>manpower to port one grsecurity release to older kernel versions.<br><br>But one thing I would like to get cleared now, since these myths
<br>about 2.6 kernel insecurities exist since ages.<br><br>I personally have the feeling that 2 or maybe 3 very conservative<br>security guys started babbling how it is much more secure to stay<br>with a 2.4 kernel. And then the lot of wannabe experts started
<br>to pick up without being able to name any facts.<br><br>At least I never came across a trustworthy whitepaper that listed<br>advantages of a 2.4 kernel of version 2.6 regarding security.<br><br>Could somebody please mention specific features in a
2.6 kernel<br>that are more insecure compared to a 2.4 kernel?<br><br><br>And about the origin question of Mike Perry I would like to say<br>that I fully agree:<br><br>The cleanest grsecurity code is the latest version which depends
<br>on the relatively new kernel. But for the cleanest kernel code<br>people advise you to go with an older but well tested kernel.<br>This is a caveat.<br><br>What if the newest grsecurity release would focus on the current
<br>kernel in the stable release of debian, for example?<br><br>Going by grsecurity and the 2.4 kernel is plain impossible with<br>the stable release of debian. Just two of multiple big problems<br>is the missing udev and acpi support.
<br><br><br>What is the advice of the experts?<br><br><br>-- <br><br>greetings from somebody who cares about facts.<br><br>