Messages in this thread | | | Date | Tue, 15 Jul 2008 09:07:37 -0700 (PDT) | From | Linus Torvalds <> | Subject | Re: [stable] Linux 2.6.25.10 |
| |
On Tue, 15 Jul 2008, pageexec@freemail.hu wrote: > > by 'cover up' i meant that even when you know better, you quite > consciously do *not* report the security impact of said bugs
Yes. Because the only place I consider appropriate is the kernel changelogs, and since those get published with the sources, there is no way I can convince myself that it's a good idea to say "Hey script kiddies, try this" unless it's already very public indeed.
> see my comment about reality above. heck, even linux vendors do track > and announce them, it's part of the support they provide to paying > customers (and even non-paying users).
Umm. And they mostly do a crap job at it, only focusing on a small percentage (the ones that were considered to be "big issues"), and because they do the reporting they also feel they have to have embargoes in place.
That's why I don't do reporting - it almost inevitably leads to embargoes.
So as far as I'm concerned, "disclosing" is the fixing of the bug. It's the "look at the source" approach.
Linus
| |