Date: Wed, 12 Jan 2005 22:37:55 -0500 (EST)
From: Rik van Riel <riel@redhat.com>
To: Marcelo Tosatti <marcelo.tosatti@cyclades.com>
cc: Linus Torvalds <torvalds@osdl.org>, Greg KH <greg@kroah.com>,
       Chris Wright <chrisw@osdl.org>, akpm@osdl.org, alan@lxorguk.ukuu.org.uk,
       linux-kernel@vger.kernel.org
Subject: Re: thoughts on kernel security issues
In-Reply-To: <20050112161227.GF32024@logos.cnet>
Message-ID: <Pine.LNX.4.61.0501122235240.27051@chimarrao.boston.redhat.com>
References: <20050112094807.K24171@build.pdx.osdl.net>
 <Pine.LNX.4.58.0501121002200.2310@ppc970.osdl.org> <20050112185133.GA10687@kroah.com>
 <Pine.LNX.4.58.0501121058120.2310@ppc970.osdl.org> <20050112161227.GF32024@logos.cnet>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1128
Lines: 27

On Wed, 12 Jan 2005, Marcelo Tosatti wrote:

> The only reason for this is to have "time for the vendors to catch up", 
> which can be defined by the kernel security office. Nothing more - no 
> vendor politics involved.

There are other good reasons, too.  One could be:

"Lets not make this security bug public on christmas eve,
  because many system administrators won't get around to
  applying patches, while the script kiddies have lots of
  time over their christmas holidays."

IMHO it will be good to coordinate things like this, based on
common sense, and trying to minimise the impact on users of
the software.  I do agree with Linus' "no politics" point,
though ;)

-- 
"Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are,
by definition, not smart enough to debug it." - Brian W. Kernighan
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/