lkml.org 
[lkml]   [2005]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: thoughts on kernel security issues


    On Wed, 12 Jan 2005, Andrew Morton wrote:
    >
    > That sounds a bit over-the-top to me, sorry.

    Maybe a bit pointed, but the question is: would a user perhaps want to
    know about a security fix a month earlier (knowing that bad people might
    guess at it too), or want the security fix a month later (knowing that the
    bad guys may well have known about the problem all the time _anyway_)?

    Being public is different from being known about. If vendor-sec knows
    about it, I don't find it at all unbelievable that some spam-virus writer
    might know about it too.

    > All of these are of exactly the same severity as the rlimit bug,
    > and nobody cares, nobody is hurt.

    The fact is, 99% of the time, nobody really does care.

    > The fuss over the rlimit problem occurred simply because some external
    > organisation chose to make a fuss over it.

    I agree. And if i thad been out in the open all the time, the fuss simply
    would not have been there.

    I'm a big believer in _total_ openness. Accept the fact that bugs will
    happen. Be open about them, and fix them as soon as possible. None of this
    cloak-and-dagger stuff.

    Linus
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2009-11-18 23:46    [W:0.191 / U:153.360 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site