Messages in this thread | | | Date | Thu, 13 Jan 2005 22:48:14 +0100 | From | Marek Habersack <> | Subject | Re: thoughts on kernel security issues |
| |
On Thu, Jan 13, 2005 at 04:30:02PM -0500, Dave Jones scribbled: > On Thu, Jan 13, 2005 at 10:02:29PM +0100, Marek Habersack wrote: > > Theory is fine, practice is that the closed disclosure list changes matters > > for a vaste minority of people - those who are to install the fixed kernels > > are in perfectly the same situation they would be in if there was a fully > > open disclosure list. > > No, it's not the same. They're in a _worse_ situation if anything. > With open disclosure, the bad guys get even more lead time. I guess it depends on how you look at it. In fact, thinking again, I think it gives the same time to the bad and good guys in each case. So it seems there is no benefit to having a closed list or an open list in this regard after all. And if this is not an issue, what might be the reason for having the closed list? The lust for glory as you've said earlier?
> If admins don't install updates in a timely manner, there's > not a lot we can do about it. For those that _do_ however, > we can make their lives a lot more stress free. Indeed, but what does have it to do with a closed disclosure list? With open disclosure list you provide a set of fixes right away, the admins take them and apply. With closed list you do the same, but with a delay (which gives an opportunity for a "race condition" with the bad guys, one could argue). So, what's the advantage of the delayed disclosure?
best regards,
marek [unhandled content-type:application/pgp-signature] | |