Messages in this thread | | | From | Kyle Moffett <> | Subject | Re: /dev/random on Linux | Date | Tue, 16 May 2006 04:52:05 -0400 |
| |
On May 16, 2006, at 04:28, Muli Ben-Yehuda wrote: > On Tue, May 16, 2006 at 04:15:19AM -0400, Kyle Moffett wrote: >> On May 15, 2006, at 22:50, Muli Ben-Yehuda wrote: >>> On Mon, May 15, 2006 at 11:41:07PM +0100, Alan Cox wrote: >>>> A paper by people who can't work out how to mail linux-kernel or >>>> vendor-sec, or follow "REPORTING-BUGS" in the source, >>> >>> Zvi did contact Matt Mackall, the current /dev/random maintainer, >>> and was very keen on discussing the paper with him. I don't think >>> he got any response. >> >> So he's demanding that one person spend time responding to his paper? > > Who said anything about demanding? he wanted to discuss the paper. > He received no response (AFAIK). Please don't read more into it.
Pardon; my wording was overly harsh, but I still want to point out that assuming an unresponsive MAINTAINERS entry indicates that the person doesn't care is totally wrong. Given the volume of email a lot of these people receive, it's very easy for it to go unnoticed or be trapped by a spam filter. Publishing to the LKML is virtually always OK; even if you have a security problem, the average turnaround for "critical" security fixes like theoretical local root exploits is around 24 hours or so. We went through about 8 stable "releases" over the course of a little more than a week because of several fairly urgent security fixes during that time.
>> The "maintainer" for any given piece of the kernel is the entry in >> MAINTAINERS *and* linux-kernel@vger.kernel.org *and* the >> appropriate sub-mailing-list. > > For security related information, it is sometimes best not to tell > the whole world about it immediately (although you should > definitely tell the whole world about it eventually). It should've > probably been posted to lkml when mpm didn't respond, I agree. I'll > take the blame for not suggesting that to Zvi.
As I said above, even the LKML is probably ok if you think you've found an actual explot. If you really feel nervous about exposing it, I believe there's a security@kernel.org email where you can send such information which will even tenatively agree to a coordinated disclosure if you can prove that it's an urgent security problem.
Cheers, Kyle Moffett
-- Premature optimization is the root of all evil in programming -- C.A.R. Hoare
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |