![]() | |||||||||||||
Messages in this thread |
On Iau, 2005-01-13 at 19:42, Marek Habersack wrote: > On Thu, Jan 13, 2005 at 03:36:27PM +0000, Alan Cox scribbled: > > We cannot do this without the reporters permission. Often we get > I think I don't understand that. A reporter doesn't "own" the bug - not the > copyright, not the code, so how come they can own the fix/report? They own the report. Who owns it is kind of irrelevant. If we publish it when they don't want it published then next time they'll send it to full-disclosure or worse still just share an exploit with the bad guys. So unless we get really stoopid requests we try not to annoy people - hole reporting is a volunatry activity > > material that even the list isn't allowed to directly see only by > > contacting the relevant bodies directly as well. The list then just > > serves as a "foo should have told you about issue X" notification. > This sounds crazy. I understand that this may happen with proprietary > software, or software that is made/supported by a company but otherwise opensource > (like OpenOffice, for instance), but the kernel? Its not uncommon. Not all security bodies (especially government security agencies) trust vendor-sec directly, only some members on the basis of their own private auditing/background checks. Alan - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2005-03-22 13:09 [from the cache] ©2003-2008 | |||||||||||||