lkml.org 
[lkml]   [2006]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: /dev/random on Linux
Date
On May 16, 2006, at 04:28, Muli Ben-Yehuda wrote:
> On Tue, May 16, 2006 at 04:15:19AM -0400, Kyle Moffett wrote:
>> On May 15, 2006, at 22:50, Muli Ben-Yehuda wrote:
>>> On Mon, May 15, 2006 at 11:41:07PM +0100, Alan Cox wrote:
>>>> A paper by people who can't work out how to mail linux-kernel or
>>>> vendor-sec, or follow "REPORTING-BUGS" in the source,
>>>
>>> Zvi did contact Matt Mackall, the current /dev/random maintainer,
>>> and was very keen on discussing the paper with him. I don't think
>>> he got any response.
>>
>> So he's demanding that one person spend time responding to his paper?
>
> Who said anything about demanding? he wanted to discuss the paper.
> He received no response (AFAIK). Please don't read more into it.

Pardon; my wording was overly harsh, but I still want to point out
that assuming an unresponsive MAINTAINERS entry indicates that the
person doesn't care is totally wrong. Given the volume of email a
lot of these people receive, it's very easy for it to go unnoticed or
be trapped by a spam filter. Publishing to the LKML is virtually
always OK; even if you have a security problem, the average
turnaround for "critical" security fixes like theoretical local root
exploits is around 24 hours or so. We went through about 8 stable
"releases" over the course of a little more than a week because of
several fairly urgent security fixes during that time.

>> The "maintainer" for any given piece of the kernel is the entry in
>> MAINTAINERS *and* linux-kernel@vger.kernel.org *and* the
>> appropriate sub-mailing-list.
>
> For security related information, it is sometimes best not to tell
> the whole world about it immediately (although you should
> definitely tell the whole world about it eventually). It should've
> probably been posted to lkml when mpm didn't respond, I agree. I'll
> take the blame for not suggesting that to Zvi.

As I said above, even the LKML is probably ok if you think you've
found an actual explot. If you really feel nervous about exposing
it, I believe there's a security@kernel.org email where you can send
such information which will even tenatively agree to a coordinated
disclosure if you can prove that it's an urgent security problem.

Cheers,
Kyle Moffett

--
Premature optimization is the root of all evil in programming
-- C.A.R. Hoare



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-05-16 10:54    [W:0.394 / U:0.552 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site