Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S261780AbVAMWOo (ORCPT ); Thu, 13 Jan 2005 17:14:44 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S261728AbVAMWOh (ORCPT ); Thu, 13 Jan 2005 17:14:37 -0500 Received: from mx1.redhat.com ([66.187.233.31]:47242 "EHLO mx1.redhat.com") by vger.kernel.org with ESMTP id S261780AbVAMWHL (ORCPT ); Thu, 13 Jan 2005 17:07:11 -0500 Date: Thu, 13 Jan 2005 17:06:52 -0500 From: Dave Jones To: Marek Habersack Cc: Alan Cox , Chris Wright , Marcelo Tosatti , Linus Torvalds , Greg KH , akpm@osdl.org, Linux Kernel Mailing List Subject: Re: thoughts on kernel security issues Message-ID: <20050113220652.GJ3555@redhat.com> Mail-Followup-To: Dave Jones , Marek Habersack , Alan Cox , Chris Wright , Marcelo Tosatti , Linus Torvalds , Greg KH , akpm@osdl.org, Linux Kernel Mailing List References: <20050112174203.GA691@logos.cnet> <1105627541.4624.24.camel@localhost.localdomain> <20050113194246.GC24970@beowulf.thanes.org> <20050113115004.Z24171@build.pdx.osdl.net> <20050113202905.GD24970@beowulf.thanes.org> <1105645267.4644.112.camel@localhost.localdomain> <20050113210229.GG24970@beowulf.thanes.org> <20050113213002.GI3555@redhat.com> <20050113214814.GA9481@beowulf.thanes.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050113214814.GA9481@beowulf.thanes.org> User-Agent: Mutt/1.4.1i Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1662 Lines: 39 On Thu, Jan 13, 2005 at 10:48:14PM +0100, Marek Habersack wrote: > > If admins don't install updates in a timely manner, there's > > not a lot we can do about it. For those that _do_ however, > > we can make their lives a lot more stress free. > Indeed, but what does have it to do with a closed disclosure list? For the N'th time, it gives vendors a chance to have packages ready at the time of disclosure. > With open > disclosure list you provide a set of fixes right away, the admins take them > and apply. With closed list you do the same, but with a delay (which gives > an opportunity for a "race condition" with the bad guys, one could argue). > So, what's the advantage of the delayed disclosure? Not having to panic and rush out releases on day of disclosure. Not having users vulnerable whilst packages build/get QA/get pushed to mirrors. Users of kernel.org kernels get to build and boot in under an hour. Vendor kernels take a lot longer to build. 1- More architectures. (And trust me, there's nothing I'd like more than to be able to increase the speed of kernel builds on some of the architectures we support). 2- More generic, ie more modules to build. In the case of public disclosure of issues that we weren't aware of, it's a miracle that we get update kernels out on day of disclosure in some cases. (In others, we don't, and the same applies to other vendors too) Dave - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/