Re: [stable] Linux 22.214.171.124 (resume)
From: Alan Cox
Date: Sat Jul 19 2008 - 06:22:26 EST
> @@ -1,7 +1,7 @@
> -Linux kernel developers take security very seriously. As such, we'd
> -like to know when a security bug is found so that it can be fixed and
> -disclosed as quickly as possible. Please report security bugs to the
> -Linux kernel security team.
> +Linux kernel developers take security very seriously, in exactly the
> +same way we do with any other bugs. As such, we'd like to know when
> +a security bug is found so that it can be fixed as soon as possible.
> +Please report security bugs to the Linux kernel security team.
NAK this. If the fix is not clear and the bug not too serious it is better
to disclose it than fail to fix it. The security team does not usually fix the
bugs, the experts in the various bits of code do.
> -Any exploit code is very helpful and will not be released without
> -consent from the reporter unless it has already been made public.
> +Any exploit code is very helpful and will not be released.
NAK this too. If someone releases an exploit publically or it leaks we
want to be able to freely share it too. Your proposal would mean any but
those dumb enough to agree to this could share it. That is why the unless made
public is part of every generic NDA document on the planet.
The rest needs Linus to return from holiday for discussion and that'll
be a week or two. In the meantime you might want to define "disclose" as
I don't think we all agree on what it means as you've not defined who is and
isn't the linux security team and/or its helpers.
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/