lkml.org 
[lkml]   [2005]   [Jan]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: thoughts on kernel security issues
On Thu, Jan 13, 2005 at 07:19:45PM +0000, Alan Cox scribbled:
> On Iau, 2005-01-13 at 19:42, Marek Habersack wrote:
> > On Thu, Jan 13, 2005 at 03:36:27PM +0000, Alan Cox scribbled:
> > > We cannot do this without the reporters permission. Often we get
> > I think I don't understand that. A reporter doesn't "own" the bug - not the
> > copyright, not the code, so how come they can own the fix/report?
>
> They own the report. Who owns it is kind of irrelevant. If we publish it
> when they don't want it published then next time they'll send it to
> full-disclosure or worse still just share an exploit with the bad guys.
> So unless we get really stoopid requests we try not to annoy people -
> hole reporting is a volunatry activity
Sounds a bit backwards to me. It's like surrendering to a guy who attacks you
on the street "because he's got a knife and I don't". There is some sense in
it, but that way you're putting yourself in a position of a victim. The
reporters... ok, they own the report, but do they own the information?

> > > material that even the list isn't allowed to directly see only by
> > > contacting the relevant bodies directly as well. The list then just
> > > serves as a "foo should have told you about issue X" notification.
> > This sounds crazy. I understand that this may happen with proprietary
> > software, or software that is made/supported by a company but otherwise opensource
> > (like OpenOffice, for instance), but the kernel?
>
> Its not uncommon. Not all security bodies (especially government
> security agencies) trust vendor-sec directly, only some members on the
> basis of their own private auditing/background checks.
So it sounds that we, the men-in-the-crowd are really left out in the crowd,
people who are affected the most by the issues. Since the vendors are not
affected by the bugs (playing a devil's advocate here), since they fix them
for their machines as they appear, way before they get public.

best regards,

marek
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 14:09    [W:0.263 / U:0.036 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site