Hacker News Reader

Comment by lloeki | Hacker News Reader

(Honest, naïve question, I lack awareness of the Linux versioning scheme) Isn't Linux way into 5.x land for quite some time? Is the testing of 4.20-rc2 some kind of proxy to test there were no backports of the very latest mainline?

----

Researchers said they tested USBFuzz on:

9 recent versions of the Linux kernel: v4.14.81, v4.15,v4.16, v4.17, v4.18.19, v4.19, v4.19.1, v4.19.2, and v4.20-rc2 (the latest version at the time of evaluation) FreeBSD 12 (the latest release) MacOS 10.15 Catalina (the latest release) Windows (both version 8 and 10, with most recent security updates installed)

View on HN

Since v3.0, Linux has treated the first _2_ numbers of it's version as something that is incremented sequentially (in the v2.6 era, the _3_rd number was used, prior to v2.6 there was a even/odd stable/unstable split)

For example, we have normal releases v4.19 then v4.20 then v5.0 then v5.1. There will never be a v4.21.

Stable releases use the third number. v4.14.81 is a stable release of v4.14.0.

So the v4.20-rc2 statement just dates the work:

    $ git show v4.20-rc2
    tag v4.20-rc2
    Tagger: Linus Torvalds <torvalds@linux-foundation.org>
    Date:   Sun Nov 11 17:12:54 2018 -0600

Woah, so they did this a year and a half ago despite releasing this year (note that the paper has a 2020 reference in it). Weird!

I guess responsible disclosure timelines on this sort of work must really suck.

I don't know about computer security, but I've published peer reviewed research papers in other fields and a year and a half from data collection to publication doesn't seem unusual to me. If anything it's pretty fast.

The linux kernel has several LTS releases for people who want to stay on the same version for stability reasons but also need security updates. I suspect from a security perspective testing whatever the latest 4.19.X version is would be roughly equivalent to 5.X.

(Except, perhaps, for any USB-related features introduced in 5.X)

Reply on news.ycombinator.com