[lkml]   [2005]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: thoughts on kernel security issues
On Wed, Jan 12, 2005 at 11:01:42AM -0800, Linus Torvalds wrote:
> On Wed, 12 Jan 2005, Greg KH wrote:
> >
> > So you would be for a closed list, but there would be no incentive at
> > all for anyone on the list to keep the contents of what was posted to
> > the list closed at any time? That goes against the above stated goal of
> > complying with RFPolicy.
> There's already vendor-sec. I assume they follow RFPolicy already. If it's
> just another vendor-sec, why would you put up a new list for it?
> In other words, if you allow embargoes and vendor politics, what would the
> new list buy that isn't already in vendor-sec.
> When I saw how vendor-sec worked, I decided I will never be on an embargo
> list. Ever. That's not to say that such a list can't work - I just
> personally refuse to have anything to do with one. Whether that matters or
> not is obviously an open question.

Of course it matters Linus - vendors need time to prepare their updates. You
can't ignore that, and you can't "have nothing to do with it".

You seem to dislike the way embargos have been done on vendorsec, fine. They can
be done on a different way, but you have to understand that you and Andrew
need to follow and agree with the embargo.

How you feel about having short fixed time embargo's (lets say, 3 or 4 days) ?

The only reason for this is to have "time for the vendors to catch up", which
can be defined by the kernel security office. Nothing more - no vendor politics

It is a simple matter of synchronization.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 14:09    [W:0.154 / U:5.196 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site