lkml.org 
[lkml]   [2008]   [Jul]   [15]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
/
DateTue, 15 Jul 2008 09:07:37 -0700 (PDT)
FromLinus Torvalds <>
SubjectRe: [stable] Linux 2.6.25.10
On Tue, 15 Jul 2008, pageexec@freemail.hu wrote:
> > by 'cover up' i meant that even when you know better, you quite
> consciously do *not* report the security impact of said bugs

Yes. Because the only place I consider appropriate is the kernel 
changelogs, and since those get published with the sources, there is no 
way I can convince myself that it's a good idea to say "Hey script 
kiddies, try this" unless it's already very public indeed.

> see my comment about reality above. heck, even linux vendors do track
> and announce them, it's part of the support they provide to paying
> customers (and even non-paying users).

Umm. And they mostly do a crap job at it, only focusing on a small 
percentage (the ones that were considered to be "big issues"), and because 
they do the reporting they also feel they have to have embargoes in place.

That's why I don't do reporting - it almost inevitably leads to embargoes.

So as far as I'm concerned, "disclosing" is the fixing of the bug. It's 
the "look at the source" approach.

		Linus


\
 
 \ /
  Last update: 2008-07-15 18:11    [from the cache]
©2003-2008