Messages in this thread | ![/](/images/icornerl.gif) | | Date | Sat, 19 Jul 2008 06:11:40 -0400 | From | Alan Cox <> | Subject | Re: [stable] Linux 2.6.25.10 (resume) |
| |
> @@ -1,7 +1,7 @@ > -Linux kernel developers take security very seriously. As such, we'd > -like to know when a security bug is found so that it can be fixed and > -disclosed as quickly as possible. Please report security bugs to the > -Linux kernel security team. > +Linux kernel developers take security very seriously, in exactly the > +same way we do with any other bugs. As such, we'd like to know when > +a security bug is found so that it can be fixed as soon as possible. > +Please report security bugs to the Linux kernel security team.
NAK this. If the fix is not clear and the bug not too serious it is better to disclose it than fail to fix it. The security team does not usually fix the bugs, the experts in the various bits of code do.
> -Any exploit code is very helpful and will not be released without > -consent from the reporter unless it has already been made public. > +Any exploit code is very helpful and will not be released.
NAK this too. If someone releases an exploit publically or it leaks we want to be able to freely share it too. Your proposal would mean any but those dumb enough to agree to this could share it. That is why the unless made public is part of every generic NDA document on the planet.
The rest needs Linus to return from holiday for discussion and that'll be a week or two. In the meantime you might want to define "disclose" as I don't think we all agree on what it means as you've not defined who is and isn't the linux security team and/or its helpers.
| ![\](/images/icornerr.gif) |