[Dailydave] [Full-disclosure] Linux's unofficial security-through-coverup policy

[Thomas Ptacek]

But Linux doesn't work like a top-down software project.

The downside of that is that if Linus finds out about your vuln, he's
either going to (a) ignore it or (b) publish an unattributed fix right
away.

But the upside is that if you want to run your own response team for
Linux with your own rules of engagement, you can do that. If you are
credible and people like your rules, you can set the agenda.

I'm not sure Linus and Alan are really in a reasonable position to
coordinate and clear advisory traffic. There are too many downstream
vendors, too many release schedules, and too much political BS.

On 7/17/08, Dave Aitel <dave at immunityinc.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
>  Hash: SHA1
>
>  I think what Brad and the Pax Team are saying here is that:
>  1. We hold Linux to a higher standard than a company - we expect the
>  term "open source" to apply to more than just the source code.
>  2. For that reason, the community finds it discomforting when kernel
>  maintainers know that a patch has a serious security ramification and
>  essentially lie about it by neglecting to put that into the patch
>  comments. That's the sort of behavior we expect from a large commercial
>  entity.
>  3. This only hurts end users, because the hackers already know about it.
>
>  If the kernel maintainers had read the Microsoft team's SDL book, they'd
>  probably be more up to speed on these things. :>
>
>  - -dave
>
>
>
>
>  Brad Spengler wrote:
>  | Valdis,
>  |
>  | Please try to stay consistent with your own arguments.  If you defeat
>  | them yourself barely into your third paragraph, you don't give me much
>  | to do!
>  |
>  | To summarize:
>  |
>  |> have any untrusted local users - for instance, my laptop.  The only users
>  |> on it are me, myself, and I<, and the guy that owned my webserver, or
>  | the guy that owned my email client, or the guy that owned my audio
>  | player, or the guy that owned my video player, or the guy that owned my
>  | web browser, or the guy that owned my FTP client, or the guy that owned
>  | my PDF reader, or the guy that owned my office application>
>  |
>  | You're a very trusting individual!
>  |
>  | This is exactly why telling someone to update if they have any
>  | "untrusted local users" just doesn't make any sense since it misleads a
>  | majority of users.  A better replacement would be "if your machine is
>  | network-connected."  How do you own a website if you can't break into it
>  | directly?  Find out what other websites are hosted on the same machine,
>  | break into one of them, then locally escalate privileges, giving you
>  | access to all the websites hosted on the machine.  If you don't think
>  | this happens, you've got your head in the sand and honestly should just
>  | give up having anything to do with security.
>  |
>  | -Brad
>  |
>
> | -------------------------
>  |
>  | _______________________________________________
>  | Dailydave mailing list
>  | Dailydave at lists.immunitysec.com
>  | http://lists.immunitysec.com/mailman/listinfo/dailydave
>
>  -----BEGIN PGP SIGNATURE-----
>  Version: GnuPG v1.4.6 (GNU/Linux)
>  Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
>  iD8DBQFIfyW1tehAhL0gheoRAr4tAJ9rZC6R+mwefYPhh3lnRZdk2O15ZgCfW+Mk
>  1QvFrE/h52PTxvUUEMY6SUY=
>  =/ydX
>  -----END PGP SIGNATURE-----
>
>  _______________________________________________
>  Dailydave mailing list
>  Dailydave at lists.immunitysec.com
>  http://lists.immunitysec.com/mailman/listinfo/dailydave
>


-- 
---
Thomas H. Ptacek // matasano security
read us on the web: http://www.matasano.com/log