Messages in this thread | | | Subject | Re: RFC: Starting a stable kernel series off the 2.6 kernel | From | Alan Cox <> | Date | Tue, 06 Dec 2005 20:35:53 +0000 |
| |
On Maw, 2005-12-06 at 01:43 +0100, Florian Weimer wrote: > As far as I know, many of the recent CVE assignments for kernel > vulnerabilities have been done by MITRE, requested by individuals > which are neither known as kernel developers, nor vendor security > folks (for "vendor" as in "we have our own legal department with real > lawyers").
Most of them will be because vendors employ security professionals to handle security CVE work and do all the tedious and terribly important tracking of bugs v releases and what needs to be fixed by whom and when - and developers to write code.
> Maybe the source of CVE assignments paints a wrong picture. But if > the CVE picture is correct, vendor-paid kernel developers help behind > the scenes, but there is little interest in openly documenting > security issues, so that users (and what kernel.org considers fringe > distros) can apply the relevant patches if they use kernel.org > kernels.
The 2.6.x.y maintainers are directly involved in security@kernel.org last time I checked.
> database. But the only answers we get is that everything is fine, > vendors handle the situation, security@kernel.org actually does this > already, etc.
Having someone doing that on kernel.org sounds a good plan
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |