full-disclosure - Re: Linux's unofficial security-through-coverup policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080717072115.GB11441@lboro.ac.uk>
Date: Thu, 17 Jul 2008 08:21:15 +0100
From: A.L.M.Buxey@...ro.ac.uk
To: Valdis.Kletnieks@...edu
Cc: full-disclosure@...ts.grok.org.uk, Brad Spengler <spender@...ecurity.net>,
	dailydave@...ts.immunitysec.com
Subject: Re: Linux's unofficial
	security-through-coverup	policy

Hi,

> Please let them know what you think of their policy of non-disclosure
> and coverups.  I hope someone also educates them on their ridiculous

http://www.kernel.org/pub/linux/kernel/v2.6/

the whole source code for Linux kernel available for _anyone_
to download, scan through, run tools against etc etc.

they have a policy of non-disclosure?  Wierd. Last time I checked
I couldnt get the source code for Windows, IOS, OSX Intel from
a repository open to anyone.  and yet those companies have
a good disclosure policy?  I dont get your point. You want them
to specifically state how a vulnerability might actually
WORK and even give you some example code to make your life easier?

alan

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/