RE: [stable] Linux 184.108.40.206
Date: Fri Jul 18 2008 - 21:00:34 EST
On Fri, 18 Jul 2008, David Schwartz wrote:
Greg KH wrote:
Personally, I omit posting full "and here is explicitly how to exploit
this problem" notices as that is foolish.
That means only people with the time, energy, and expertise to create an
exploit will have an exploit. This includes probably 90% of the people who
would use the exploit maliciously
haven't you ever heard of script-kiddies? they are by far the majority of
attacks on systems but do not have the expertise to create exploits. it
takes someone else writing the exploit for them and packaging it to make
them a threat.
in the meantime there's a chance for the fix to get propogated out to a
released version and for people to upgrade their systems. providing
exploit code along with the bugfix means that the script kiddies have the
exploit immediatly, but the fix isn't in any released version (not even a
-rc or daily -git snapshot)
and 100% of the people who pose a real
thread to the community.
this depends on how you define threat.
It does, however, ensure that the majority of
ordinary users won't be able to test their systems to see if they're
vulnerable or if the vulnerability is fixed. So at least it will have some
how many people run exploits against their production systems to 'see if
they are fixed', very few, and those only on strict schedules with lots of
adnvance notice and other safeguards.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/