RE: [stable] Linux

From: david
Date: Fri Jul 18 2008 - 21:00:34 EST

On Fri, 18 Jul 2008, David Schwartz wrote:

Greg KH wrote:

Personally, I omit posting full "and here is explicitly how to exploit
this problem" notices as that is foolish.

That means only people with the time, energy, and expertise to create an
exploit will have an exploit. This includes probably 90% of the people who
would use the exploit maliciously

haven't you ever heard of script-kiddies? they are by far the majority of attacks on systems but do not have the expertise to create exploits. it takes someone else writing the exploit for them and packaging it to make them a threat.

in the meantime there's a chance for the fix to get propogated out to a released version and for people to upgrade their systems. providing exploit code along with the bugfix means that the script kiddies have the exploit immediatly, but the fix isn't in any released version (not even a -rc or daily -git snapshot)

and 100% of the people who pose a real
thread to the community.

this depends on how you define threat.

It does, however, ensure that the majority of
ordinary users won't be able to test their systems to see if they're
vulnerable or if the vulnerability is fixed. So at least it will have some

how many people run exploits against their production systems to 'see if they are fixed', very few, and those only on strict schedules with lots of adnvance notice and other safeguards.

David Lang

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at