Messages in this thread | | | Date | Thu, 13 Jan 2005 21:44:15 +0100 | From | Marek Habersack <> | Subject | Re: thoughts on kernel security issues |
| |
On Thu, Jan 13, 2005 at 07:19:45PM +0000, Alan Cox scribbled: > On Iau, 2005-01-13 at 19:42, Marek Habersack wrote: > > On Thu, Jan 13, 2005 at 03:36:27PM +0000, Alan Cox scribbled: > > > We cannot do this without the reporters permission. Often we get > > I think I don't understand that. A reporter doesn't "own" the bug - not the > > copyright, not the code, so how come they can own the fix/report? > > They own the report. Who owns it is kind of irrelevant. If we publish it > when they don't want it published then next time they'll send it to > full-disclosure or worse still just share an exploit with the bad guys. > So unless we get really stoopid requests we try not to annoy people - > hole reporting is a volunatry activity Sounds a bit backwards to me. It's like surrendering to a guy who attacks you on the street "because he's got a knife and I don't". There is some sense in it, but that way you're putting yourself in a position of a victim. The reporters... ok, they own the report, but do they own the information?
> > > material that even the list isn't allowed to directly see only by > > > contacting the relevant bodies directly as well. The list then just > > > serves as a "foo should have told you about issue X" notification. > > This sounds crazy. I understand that this may happen with proprietary > > software, or software that is made/supported by a company but otherwise opensource > > (like OpenOffice, for instance), but the kernel? > > Its not uncommon. Not all security bodies (especially government > security agencies) trust vendor-sec directly, only some members on the > basis of their own private auditing/background checks. So it sounds that we, the men-in-the-crowd are really left out in the crowd, people who are affected the most by the issues. Since the vendors are not affected by the bugs (playing a devil's advocate here), since they fix them for their machines as they appear, way before they get public.
best regards,
marek [unhandled content-type:application/pgp-signature] | |