Messages in this thread | ![/](/images/icornerl.gif) | | From | pageexec@freemail ... | Date | Tue, 15 Jul 2008 22:23:45 +0200 | Subject | Re: [stable] Linux 2.6.25.10 |
| |
On 15 Jul 2008 at 13:18, Linus Torvalds wrote:
> > > On Tue, 15 Jul 2008, pageexec@freemail.hu wrote: > > > > in any case, i don't see why you can't put keywords into the commit > > that say the bug being fixed is 'security related' or 'potentially > > exploitable', etc. people can then decide how to prioritize them. > > Because I see no point. Quite often, we don't even realize some random bug > could have been a security issue. > > It's not worth my energy, in other words.
i understand and i think noone expects that. in fact, i know how much expertise and time it takes to determine that. but what happens when you do figure out the security relevance of a bug during bug submission (say, it goes directly to security@kernel.org with a PoC to trigger it) or while working out the fix or you see that it falls into an well-known exploitable bug class? you have the information yet you still make no mention of it. *that* at least can be fixed, if you chose so.
cheers, PaX Team
| ![\](/images/icornerr.gif) |