Messages in this thread | | | Date | Tue, 11 Jan 2005 02:09:31 +0100 | From | Diego Calleja <> | Subject | Re: Proper procedure for reporting possible security vulnerabilities? |
| |
El Mon, 10 Jan 2005 16:40:02 -0800 Chris Wright <chrisw@osdl.org> escribió:
> Problem is, the rest of the world uses a security contact for reporting > security sensitive bugs to project maintainers and coordinating > disclosures. I think it would be good for the kernel to do that as well.
(somewhat OT..)
Perhaps it's just me, but i think it'd be nice that a new kernel version is released every time a security issue is found.
Yes, vendors update their kernels themselves, but there's a *lot* of people in linux who run kernel.org kernels, and it's hopefully to keep working that way.
Those people can also update themselves their kernel, also true. But the security issues found in linux are not announced anywhere but mailing list and sites like slashdot. Many people who run kernels from kernel.org don't read slashdot or mailing lists and don't that there's a need of updating their kernels. A new kernel version every time a security issue is found would help for those people, or at least a "security updates" section in kernel.org's webpage. Right now there's no "official" way of announcing those updates, and I think it's a serious lack for a OS which is so widely used. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |