lkml.org 
[lkml]   [2008]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [stable] Linux 2.6.25.10 (resume)
    > @@ -1,7 +1,7 @@
    > -Linux kernel developers take security very seriously. As such, we'd
    > -like to know when a security bug is found so that it can be fixed and
    > -disclosed as quickly as possible. Please report security bugs to the
    > -Linux kernel security team.
    > +Linux kernel developers take security very seriously, in exactly the
    > +same way we do with any other bugs. As such, we'd like to know when
    > +a security bug is found so that it can be fixed as soon as possible.
    > +Please report security bugs to the Linux kernel security team.

    NAK this. If the fix is not clear and the bug not too serious it is better
    to disclose it than fail to fix it. The security team does not usually fix the
    bugs, the experts in the various bits of code do.

    > -Any exploit code is very helpful and will not be released without
    > -consent from the reporter unless it has already been made public.
    > +Any exploit code is very helpful and will not be released.

    NAK this too. If someone releases an exploit publically or it leaks we
    want to be able to freely share it too. Your proposal would mean any but
    those dumb enough to agree to this could share it. That is why the unless made
    public is part of every generic NDA document on the planet.


    The rest needs Linus to return from holiday for discussion and that'll
    be a week or two. In the meantime you might want to define "disclose" as
    I don't think we all agree on what it means as you've not defined who is and
    isn't the linux security team and/or its helpers.



    \
     
     \ /
      Last update: 2008-07-19 12:25    [W:0.022 / U:92.860 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site