lkml.org 
[lkml]   [2005]   [Jan]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: thoughts on kernel security issues
On Thu, Jan 13, 2005 at 04:30:02PM -0500, Dave Jones scribbled:
> On Thu, Jan 13, 2005 at 10:02:29PM +0100, Marek Habersack wrote:
> > Theory is fine, practice is that the closed disclosure list changes matters
> > for a vaste minority of people - those who are to install the fixed kernels
> > are in perfectly the same situation they would be in if there was a fully
> > open disclosure list.
>
> No, it's not the same. They're in a _worse_ situation if anything.
> With open disclosure, the bad guys get even more lead time.
I guess it depends on how you look at it. In fact, thinking again, I think
it gives the same time to the bad and good guys in each case. So it seems
there is no benefit to having a closed list or an open list in this regard
after all. And if this is not an issue, what might be the reason for having
the closed list? The lust for glory as you've said earlier?

> If admins don't install updates in a timely manner, there's
> not a lot we can do about it. For those that _do_ however,
> we can make their lives a lot more stress free.
Indeed, but what does have it to do with a closed disclosure list? With open
disclosure list you provide a set of fixes right away, the admins take them
and apply. With closed list you do the same, but with a delay (which gives
an opportunity for a "race condition" with the bad guys, one could argue).
So, what's the advantage of the delayed disclosure?

best regards,

marek
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2005-03-22 14:09    [W:0.177 / U:0.296 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site