Re: How to fix problems with the sashiko review model

On Wed, 22 Jul 2026 16:25:03 +0200
Johannes Berg <[email protected]> wrote:

> There's also a risk thing - if you erroneously get a report for SCSI (as
> you did, IIUC) then you can opt out at that point and not worry about it
> again.
> 
> If we erroneously _don't_ get a report for something that didn't speak
> up because they're not on the list, didn't dare say anything, didn't pay
> attention, etc. then nobody ever knows until someone starts exploiting
> it?

I agree with Johannes here. It's one thing to get an annoying report that
says "You can be compromised by your hardware" when the hardware is
trusted. I have the same issue with boot parameters. But I rather opt-in
than have the case that I'm the odd one out where my hardware is not
trustworthy, but I don't know I have to take action to have it checked.

That is, getting a false positive tells you that you need to take action to
opt out (perhaps the report can say "if you trust the hardware go to <link>
to opt out of this message). But it's much worse if we let security issues
escape because the maintainer didn't opt-in. As there's nothing to tell the
maintainer they need to opt-in to begin with.

-- Steve