Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S261439AbVAMBee (ORCPT ); Wed, 12 Jan 2005 20:34:34 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S261355AbVALVV3 (ORCPT ); Wed, 12 Jan 2005 16:21:29 -0500 Received: from mail.dif.dk ([193.138.115.101]:8173 "EHLO mail.dif.dk") by vger.kernel.org with ESMTP id S261448AbVALVDB (ORCPT ); Wed, 12 Jan 2005 16:03:01 -0500 Date: Wed, 12 Jan 2005 22:05:36 +0100 (CET) From: Jesper Juhl To: Chris Wright Cc: Jesper Juhl , Alan Cox , Steve Bergman , Linux Kernel Mailing List , torvalds@osdl.org Subject: Re: Proper procedure for reporting possible security vulnerabilities? In-Reply-To: <20050111132905.N10567@build.pdx.osdl.net> Message-ID: References: <41E2B181.3060009@rueb.com> <87d5wdhsxo.fsf@deneb.enyo.de> <41E2F6B3.9060008@rueb.com> <20050110164001.Q469@build.pdx.osdl.net> <1105461562.16168.46.camel@localhost.localdomain> <20050111132905.N10567@build.pdx.osdl.net> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1663 Lines: 38 On Tue, 11 Jan 2005, Chris Wright wrote: > * Jesper Juhl (juhl-lkml@dif.dk) wrote: > > > > This thread got started by a question about how to go about informing > > people about security vulnerabilities so I think we should erhaps try to > > provide some sensible information about how to go about that that can be > > useful to people no matter what "disclosure camp" the agree with. How > > about something like what I've written below as an addition to > > REPORTING-BUGS or as a seperate REPORTING-SECURITY-BUGS document ? > > Let's just bite the bullet... > No value in providing some info on what's the apreciated behaviour for both the coordinated disclosure and full disclosure people of the world? Both camps are going to continue to exist, and if you only provide information on the prefered aproach for coordinated disclosure then you have even less influence on how the full disclosure camp will spread the info - if you provide some info for them as well, at least some are going to follow it and then more of the proper kernel people will get notified at once instead of finding out later via other channels. I still think adding something along the lines of what I wrote to REPORTING-BUGS has merrit. -- Jesper Juhl PS. Linus, adding you to CC since you're involved in the new thread on more or less the same topic, so I thought you might be interrested in this thread as well. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/