lkml.org 
[lkml]   [2005]   [Dec]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: RFC: Starting a stable kernel series off the 2.6 kernel
    From
    Date
    On Maw, 2005-12-06 at 01:43 +0100, Florian Weimer wrote:
    > As far as I know, many of the recent CVE assignments for kernel
    > vulnerabilities have been done by MITRE, requested by individuals
    > which are neither known as kernel developers, nor vendor security
    > folks (for "vendor" as in "we have our own legal department with real
    > lawyers").

    Most of them will be because vendors employ security professionals to
    handle security CVE work and do all the tedious and terribly important
    tracking of bugs v releases and what needs to be fixed by whom and when
    - and developers to write code.

    > Maybe the source of CVE assignments paints a wrong picture. But if
    > the CVE picture is correct, vendor-paid kernel developers help behind
    > the scenes, but there is little interest in openly documenting
    > security issues, so that users (and what kernel.org considers fringe
    > distros) can apply the relevant patches if they use kernel.org
    > kernels.

    The 2.6.x.y maintainers are directly involved in security@kernel.org
    last time I checked.

    > database. But the only answers we get is that everything is fine,
    > vendors handle the situation, security@kernel.org actually does this
    > already, etc.

    Having someone doing that on kernel.org sounds a good plan

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-12-06 21:39    [W:0.020 / U:34.864 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site