[wplug] VMware issues.

[Patrick Wagstrom]

Christopher DeMarco wrote:
> On Thu, Apr 26, 2007 at 08:30:47AM -0400, Patrick Wagstrom wrote:
> 
>> The solution to these problem is to grab the patch from VMWare's kernel 
>> guy.  You can find them at:
> 
> This looks like the author of the any-any patch?
> 
> The problem I have with these solutions is that I don't trust them,
> they're anonymous.  Why aren't they signed?  At least then I'd have
> SOME unguent for my lazy paranoia...
> 
> Please don't mention my blind trust in the Debian/Ubuntu PGP keyring;
> I've got my head in the sand and won't hear you.
> 
> But seriously -- am I missing some blessing that yes, these fixes are
> audited and not trojaned?

Here's my problem with that argument.  You're saying that you're 
paranoid about the security of these fixes but:

1. You're running proprietary code
2. You're running proprietary code under an environment that is 
documented as being unsupported
3. You're running a bleeding edge untested version of the Ubuntu

In light of those, adding in a third thing, where you can see the 
entirety of the code in the patch, doesn't seem like such a big thing.

If you're that paranoid about the issue, my suggestion is to stop 
running VMWare on the flavor of the week and run it on RHEL or CentOS. 
Either that or switch to KVM which is present in Linux 2.6.20.

--Patrick