Re: RFC: Adding a SECURITY.md document to the Binutils

Siddhesh Poyarekar
2023-04-13T12:00:50Z

On 2023-04-13 01:16, Alan Modra wrote:
>> That's not a crossing of privilege boundaries;
>
> I know. Ah, I see. You were saying that only the very narrow case of
> a privilege escalation will be considered a "security bug". Fair
> enough I suppose, but that's close to the much simpler and more easily
> understood:
>
> "binutils makes no claim to being secure, ergo there are no security
> bugs".

More like, "don't put Turing complete interfaces out on the internet
without sandboxing for everyone to abuse, that's insecure" :)

I hope to put out something similar for gcc too, and pretty much every
compiler/translator out there because they're not programs that one puts
out on the internet and think that everything will be OK. They must be
sandboxed. The overzealous CVE assignments are simply wasting
everyone's time and distracting everyone from actual security issues.

Sid