lkml.org 
[lkml]   [2005]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: thoughts on kernel security issues


    On Wed, 12 Jan 2005, Marcelo Tosatti wrote:
    >
    > How you feel about having short fixed time embargo's (lets say, 3 or 4 days) ?

    Please realize that I don't have any problem with a short-term embargo per
    se, what I have problems with is the _politics_ that it causes. For
    example, I do _not_ want this to become a

    "vendor-sec got the information five weeks ago, and decided to embargo
    until day X, and then because they knew of the 4-day policy of the
    kernel security list, they released it to the kernel security list on
    day X-4"

    See? That is playing politics with a security list. That's the part I
    don't want to have anything to do with. If somebody did that to me, I'd
    feel pissed off like hell, and I'd say "screw them".

    But in the absense of politics, I'd _happily_ have a self-imposed embargo
    that is limited to some reasonable timeframe (and "reasonable" is
    definitely counted in days, not weeks. And absolutely _not_ in months,
    like apparently sometimes happens on vendor-sec).

    So if the embargo time starts ticking from _first_ report, I'd personally
    be perfectly happy with a policy of, say "5 working days" (aka one week),
    or until it was made public somewhere else.

    IOW, if it was released on vendor-sec first, vendor-sec could _not_ then
    try to time the technical list (unless they do so in a very timely manner
    indeed).

    I'm not saying that we'd _have_ to go public after five days. I'm saying
    that after that, there would be nothing holding it back (but maybe the
    technical discussion on how to _fix_ it is still on-going, and that might
    make people just not announce it until they're ready).

    Linus
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2009-11-18 23:46    [W:0.029 / U:30.216 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site