Messages in this thread | | | From | Kyle Moffett <> | Subject | Re: OT] Joerg Schilling flames Linux on his Blog | Date | Wed, 25 May 2005 19:12:18 -0400 |
| |
On May 25, 2005, at 09:15:33, Joerg Schilling wrote: > If Linux believes that there should be enhanced security similar to > Solaris and > if Linux is a true open Source business, then I would expect that > there is > cooperation. If I change things in e.g. mkisofs or cdrecord that > could result > in problems for my "users", I send a notification mail to the > XCDRoast & k3b > authors early enough.
There was a security hole in the CD burner support. The Linux Kernel developers fixed it quickly. They were not planning to wait 6 months for you to get an updated version of cdrecord out the door in any case. If you want more information on the Linux Kernel security policy, please see a recent copy of the linux kernel for the file Documentation/SecurityBugs. To quote the relevant part: "It is reasonable to delay disclosure ... or for vendor coordination. However we expect these delays to be short, measurable in days, not weeks or months." Part of this policy includes "we'd like to know when a security bug is found so that it can be fixed and disclosed as quickly as possible." This seems to imply that the security team is not likely to wait 6 months to fix a critical hardware-damaging vulnerability.
> If the cause for the change really was the "security problem" > caused by the > fact that Linux did allow to send SCSI commands on R/O file > descriptors it > would have been sufficient to require R/W permissions on the fd. > After this > putative small change, the supposed problem would have been fixed > and cdrtools > as well as other users of the interface did work as before.
I will not debate this issue with you. Please see the copious quantities of emails when this issue was brought up a while ago.
Cheers, Kyle Moffett
-----BEGIN GEEK CODE BLOCK----- Version: 3.12 GCM/CS/IT/U d- s++: a18 C++++>$ UB/L/X/*++++(+)>$ P+++(++++)>$ L++++(+++) E W++(+) N+++(++) o? K? w--- O? M++ V? PS+() PE+(-) Y+ PGP+++ t+(+++) 5 X R? tv-(--) b++++(++) DI+ D+ G e->++++$ h!*()>++$ r !y?(-) ------END GEEK CODE BLOCK------
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |