Re: security alerts in busybox

On Sat, 25 Apr 2026 at 16:19, Hans Ulli Kroll <[email protected]> wrote:
>
> On Fri, 2026-04-24 at 16:40 +0200, Roberto A. Foglietta via busybox
> wrote:
...
> >
> > https://github.com/robang74/busybox/commits/security/
> >
> > commit f69e57f62798ae2bca9f5071adb45bfb002002b1 (HEAD -> security,
...
> besides the ongoing discussion ...
> which may or may not helpful
>
> your commit message makes no sense.
>
> YES I can read the code too,

I hardly can believe that, if you would be able to, then you have
noticed that the trivial fixes belong to all the same class:

ctime -> ctime_r
gmtime -> gmtime_r
localtime -> localtime_r

A change that weighs 193ppm (part per million) on overall full-feature
stripped busybox dynamically link thus less impactful (98ppm) on a
static compiled one which for almost all the case cannot be affected
by those problems, e.g, the Intel/AMD or ARM64 into Ubuntu.

+:git-shell:security:busybox> size busybox
   text    data     bss     dec     hex filename
3518497   40022   29674 3588193 36c061 busybox
+:git-shell:security:busybox> file busybox
busybox: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux),
statically linked,
BuildID[sha1]=145e8f3edc796b67e5efc42d8e162d770e51c695, for GNU/Linux
3.2.0, stripped

So the changes are self-explicative and why did I did them? Because
that changes are trivial, adds almost nothing and strongly makes every
certification process much easier. Obviously, other issues aren't
necessarily so trivial in being solved in a proper/acceptable manner
for busybox. And again, no explanation should be given because a) the
code is self-explanatory and b) GPLv2 implies only sharing the code,
not explaining anything further.

Few consultancy companies and a couple of linux distributions will
face a nightmare in justifying their past conduct with their clients?
Not a problem of mine, again.

Please, push forward this theatre. So, managers and CEO can justify
themselves with "it is a complex matter, there is no consensus among
technicians also". We just heard this stuff about other crysis, right?

Weird enough, but here we are.

Best regards, R-