Re: security alerts in busybox

Hi,

On Mon, Apr 27, 2026 at 08:39:56PM +0200, Roberto A. Foglietta via busybox wrote:
> > But your commit message says only fixed issue number *something*
> 
> So what?

Such commit logs are useless for others, especially after ten years
when trying to check later why some change was done. Those messages are
typical corporate way "let's call it a day/week" commits.

> It is not just about security, I wrote in first place that from a
> security PoV I consider these 44 alerts about ctime, gmtime,
> localtime, can be easily considered false positives.
> 
> I have also explained that it is a move towards supporting alternative
> approaches to fork(), like NOMMU vfork() even threads in such
> infrastructure in which efficiency is a matter of scaling.
> 
> Keep in consideration that this long and convoluted e-mail create
> distress in technical m-list.

You could have avoided it by providing clean reviewable commits with
good messages, technical rationale and background information. Also
accepting feedback.

A.