![]() | |||||||||||||
Messages in this thread |
* Florian Weimer (fw@deneb.enyo.de) wrote: > * Chris Wright: > > > This same discussion is taking place in a few forums. Are you opposed to > > creating a security contact point for the kernel for people to contact > > with potential security issues? > > Would this be anything but a secretary in front of vendor-sec? Yes, it'd be the primary contact for handling kernel security issues. Handling vendor coordination is only one piece of a handling security issue. > > http://www.wiretrip.net/rfp/policy.html > > > > Right now most things come in via 1) lkml, 2) maintainers, 3) vendor-sec. > > It would be nice to have a more centralized place for all of this > > information to help track it, make sure things don't fall through > > the cracks, and make sure of timely fix and disclosure. > > You mean, like issuing *security* *advisories*? *gasp* Yes, although we're not even tracking things well, let alone advisories. > I think this is an absolute must (and we are certainly not alone!), > but this project does not depend on the way the initial initial > contact is handled. > > > + If it is a security bug, please copy the Security Contact listed > > +in the MAINTAINERS file. They can help coordinate bugfix and disclosure. > > If this is about delayed disclosure, a few more details are required, > IMHO. Otherwise, submitters will continue to use their > well-established channels. Most people hesitate before posting stuff > they view sensitive to a mailing list. Yes, that's the point of coordinating the fix _and_ the disclosure. thanks, -chris -- Linux Security Modules http://lsm.immunix.org http://lsm.bkbits.net - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2005-03-22 14:09 [from the cache] ©2003-2008 | |||||||||||||