![]() | |||||||||||||
Messages in this thread |
* Linus Torvalds (torvalds@osdl.org) wrote: > On Wed, 12 Jan 2005, Chris Wright wrote:> > > > Right, I know you don't like the embargo stuff.> > I'd very happy with a "private" list in the sense that people wouldn't > feel pressured to fix it that day, and I think it makes sense to have some > policy where we don't necessarily make them public immediately in order to > give people the time to discuss them. That's what I figured you meant. > But it should be very clear that no entity (neither the reporter nor any > particular vendor/developer) can require silence, or ask for anything more > than "let's find the right solution". A purely _technical_ delay, in other > words, with no politics or other issues involved. Agreed. > Otherwise it just becomes politics: you end up having security firms that > want a certain date because they want a PR blitz, and you end up having > vendors who want a certain date because they have release issues. There is value in coordinating with vendors, namely to keep them from being caught with pants down. But vendor-sec already does this part well enough. > Does that mean that vendor-sec would end up being used for some things, > where people _want_ the politics and jockeying for position? Probably. > But having a purely technical alternative would be wonderful. > > > > If that means that you can get only the list by invitation-only, that's > > > fine. > > > > Opinions on where to set it up? vger, osdl, ...?> > I don't personally think it matters. Especially if we make it very clear > that it's purely technical, and no vendor politics can enter into it. > Whatever ends up being easiest. Well, easiest for me is here ;-) thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2005-03-22 14:09 [from the cache] ©2003-2008 | |||||||||||||