On: FBI release a report on Russian Linux Malware call...

[djsumdog]

> Linux Kernel 3.7

I thought I had read that incorrectly in previous reports, but I guess not. Which major distributions still have supported releases running 3.7?! I'm guessing it's gotta be RedHat and older Ubuntu LTS releases? Everything I currently have access to seems to be running at least the 4.x series.

So the most vulnerable would probably be legacy systems or old servers riddled with technical debt?

[mgkimsal → djsumdog]

Centos/RHEL 6 is still 'supported' through Nov 2020, and ships with 2.6 kernel. Centos/RHEL 7 ships with 3.1, and will be supported through June 2024.

[cesarb → mgkimsal]

> Centos/RHEL 7 ships with 3.1,

No, RHEL 7 and thus CentOS 7 ship with kernel 3.10 (see https://en.wikipedia.org/wiki/RHEL and https://access.redhat.com/articles/rhel-limits).

[SEJeff → mgkimsal]

CentOS / RHEL7 ships with Linux 3.10. That is not the same as 3.1.

[iso1631 → SEJeff]

Which Centos shipped with 3.11 for workgroups?

[mgkimsal → mgkimsal]

Ed: yes, 3.10, not 3.1. The issue reported was in 3.17, IIRC.

[_1qd4 → djsumdog]

> So the most vulnerable would probably be legacy systems or old servers riddled with technical debt?

You mean the systems that run our banking infrastructure? The systems that run the power grid? Or the ones that run in embedded devices?

Perhaps the Russians intentionally targeted an older version knowing that our most important systems are often legacy and old.

[chromedev → djsumdog]

Geez, I'm running 5.8.1. Why is RHEL so slow?

[SteveNuts → chromedev]

Stability for enterprise customers is priority #1

[brian_herman__ → SteveNuts]

They maintain their own tree and backport the necessary features.

[folmar → brian_herman__]

Also 2.4 and 2.6 is _really_ rock solid. Things were at a slower pace back then.

[chromedev → SteveNuts]

I don't think running older software automatically equals stability, and is a false sense of security. There are a lot of tools and techniques to automatically handle issues with software that are transparent to the end user.

[maltalex → chromedev]

The very definition of stable is "not changing".

Running an old, battle hardened kernel that gets the occasional bug fix/security patch is about as stable as you can get in software.

[chromedev → maltalex]

Which dictionary? Stability doesn't mean the software can't change. It has more to do with not being broken, than not changing. The latest stable Linux kernel is 5.8.3.

[usefulcat → chromedev]

Stability and security are two different things.

[chromedev → usefulcat]

In this instance I meant security, as in to feel secure. Like a security blanket.

[washadjeffmad → chromedev]

This is true if the software isn't being maintained. I rely on a few deprecated utilities that are stable in the very limited sense that they will likely never break on their own in the current way they are being used. They doesn't mean they're not currently vulnerable.

Systems are as stable as their most vulnerable components. I don't think that's a contentious notion at all.