lkml.org 
[lkml]   [2008]   [Jul]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [stable] Linux 2.6.25.10
On 15 Jul 2008 at 13:18, Linus Torvalds wrote:

>
>
> On Tue, 15 Jul 2008, pageexec@freemail.hu wrote:
> >
> > in any case, i don't see why you can't put keywords into the commit
> > that say the bug being fixed is 'security related' or 'potentially
> > exploitable', etc. people can then decide how to prioritize them.
>
> Because I see no point. Quite often, we don't even realize some random bug
> could have been a security issue.
>
> It's not worth my energy, in other words.

i understand and i think noone expects that. in fact, i know how much
expertise and time it takes to determine that. but what happens when
you do figure out the security relevance of a bug during bug submission
(say, it goes directly to security@kernel.org with a PoC to trigger it)
or while working out the fix or you see that it falls into an well-known
exploitable bug class? you have the information yet you still make no
mention of it. *that* at least can be fixed, if you chose so.

cheers,
PaX Team



\
 
 \ /
  Last update: 2008-07-15 22:29    [W:0.291 / U:0.020 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site