lkml.org 
[lkml]   [2005]   [Jan]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: thoughts on kernel security issues


On Fri, 14 Jan 2005, Theodore Ts'o wrote:
>
> I disagree. First of all, we can't know what motivates someone, and
> presuming that we know their motivation is something that should only
> be done with the greatest of care. Secondly, someone who does want
> cheap PR can do so without delaying their disclosure; they can issue a
> breathless press release or "security advisory" about a DOS attack
> just easily with a zero-day disclosure as they can with a two-week
> delayed disclosure.

Your "secondly" is bogus.

Sure, you can do that, and if you do that, then the world recognizes you
for what you are - nothing but a publicity-seeking creep.

THAT is why vendor-sec is bad. It allows publicity-seeking creeps to take
on the mantle of being "good".

I'm arguing for exposing them for what they are. If that hurts some
feelings, tough ;)

> > (a) accepting that bugs happen, and that they aren't news, but making
> > sure that the very openness of the process means that people know
> > what's going on exactly because it is _open_, not because some news
> > organization had to make a big stink about it just to make a vendor
> > take notice.
>
> A one or two week delay is hardly cause for "a news organization to
> make a big stick so vendors will take notice".

You ignore reality.

It's not a one- or two-week delay. Once the vendor-sec mentality takes
effect, the delay inevitably grows. You _always_ have excuses for
delaying, and as shown by this thread, a _lot_ of people believe them.

Also, even a one- or two-week delay _is_ actually detrimental. It means
that you can't handle the problem when it happens, so it gets queued up.
People cannot inform unrelated third parties about their patches (because
they are embargoed), which means that they get out of sync, and suddenly
the thing that open source is so good at - namely making communication
work well - becomes a problem.

> > And let's not kid ourselves: the security firms may have resources that
> > they put into it, but the worst-case schenario is actual criminal intent.
> > People who really have resources to study security problems, and who have
> > _no_ advantage of using vendor-sec at all. And in that case, vendor-sec is
> > _REALLY_ a huge mistake.
>
> Nah. If you have criminal intent, generally there are far easier ways
> to target a specific company.

The spam-viruses clearly show that that isn't always true, though. The
advantage to targeting the whole infrastructure _is_ clearly there.

Linus
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2009-11-18 23:46    [W:0.223 / U:0.072 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site