Once again, another badly misleading headline from tis author. Last time, "Linux Kernel Security is Lacking" led to a discussion about the lack of a kernel "security coordinator", an issue that has little or nothing to do with the actual security of the Linux kernel (and was founded on some very questionable assumptions to begin with). Now, essentially the same headline leads to an article talking about fork bombs, which the author himself admits is not a kernel problem. It's a distribution problem - the distro creators do not set reasonable limits. The author even proves it by mention Debian is not affected! And trying to tie it back to the kernel by saying the kernel should be enforcing reasonable limits is a bogus argument, because as others have pointed out the number of processes the kernel can run is a user-configurable setting, not a vulnerability.

If SecurityFocus is going to critique Linux kernel security, fine, but they should do so using a reporter who knows something about the topic and headlines that accurately describe the content of the article.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/308/30998#30998