lkml.org 
[lkml]   [2005]   [Jan]   [12]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
DateWed, 12 Jan 2005 18:51:36 -0800 (PST)
FromLinus Torvalds <>
SubjectRe: thoughts on kernel security issues
On Wed, 12 Jan 2005, Andrew Morton wrote:
> > That sounds a bit over-the-top to me, sorry.

Maybe a bit pointed, but the question is: would a user perhaps want to 
know about a security fix a month earlier (knowing that bad people might 
guess at it too), or want the security fix a month later (knowing that the 
bad guys may well have known about the problem all the time _anyway_)?

Being public is different from being known about. If vendor-sec knows 
about it, I don't find it at all unbelievable that some spam-virus writer 
might know about it too.

>  All of these are of exactly the same severity as the rlimit bug,
> and nobody cares, nobody is hurt.

The fact is, 99% of the time, nobody really does care. 

> The fuss over the rlimit problem occurred simply because some external
> organisation chose to make a fuss over it.

I agree. And if i thad been out in the open all the time, the fuss simply 
would not have been there.

I'm a big believer in _total_ openness. Accept the fact that bugs will 
happen. Be open about them, and fix them as soon as possible. None of this 
cloak-and-dagger stuff.

		Linus
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:09    [from the cache]
©2003-2008