RFC: Adding a SECURITY.md document to the Binutils

[Siddhesh Poyarekar]

On 2023-04-13 01:16, Alan Modra wrote:
>> That's not a crossing of privilege boundaries;
> 
> I know.  Ah, I see.  You were saying that only the very narrow case of
> a privilege escalation will be considered a "security bug".  Fair
> enough I suppose, but that's close to the much simpler and more easily
> understood:
> 
> "binutils makes no claim to being secure, ergo there are no security
> bugs".

More like, "don't put Turing complete interfaces out on the internet 
without sandboxing for everyone to abuse, that's insecure" :)

I hope to put out something similar for gcc too, and pretty much every 
compiler/translator out there because they're not programs that one puts 
out on the internet and think that everything will be OK.  They must be 
sandboxed.  The overzealous CVE assignments are simply wasting 
everyone's time and distracting everyone from actual security issues.

Sid