Date: Thu, 17 Jul 2008 10:35:21 -0400
From: "Elazar Broad" <elazar@...hmail.com>
To: spender@...ecurity.net, dave@...unityinc.com
Cc: full-disclosure@...ts.grok.org.uk, dailydave@...ts.immunitysec.com
Subject: Re: 
	[Dailydave] Linux's unofficial	security-through-coverup policy

I could understand why Linus is against classifying a commit 
comment in his branch or in a any unstable branch for that 
matter...then again, the repositories are open, and anyone with 
half a brain might be able to discern what has security 
ramifications or not. On the other hand classifying commit comments 
in stable branch(es) is a must, and the lack of CVE identifiers is 
very troublesome. 

Well, if they aren't going to do it, its up to the community to 
point it out, get the issues tracked in SecurityFocus and the like 
so that people know that its out there and the distros along with 
the general public don't have to rely on "HIGHLY SUGGESTED THAT YOU 
UPGRADE" announcements from the kernel maintainers without knowing 
why.

Elazar

On Thu, 17 Jul 2008 06:57:57 -0400 Dave Aitel 
<dave@...unityinc.com> wrote:
>I think what Brad and the Pax Team are saying here is that:
>1. We hold Linux to a higher standard than a company - we expect 
>the 
>term "open source" to apply to more than just the source code.
>2. For that reason, the community finds it discomforting when 
>kernel 
>maintainers know that a patch has a serious security ramification 
>and 
>essentially lie about it by neglecting to put that into the patch 
>comments. That's the sort of behavior we expect from a large 
>commercial 
>entity.
>3. This only hurts end users, because the hackers already know 
>about it.
>
>If the kernel maintainers had read the Microsoft team's SDL book, 
>they'd 
>probably be more up to speed on these things. :>
>
>-dave
>
>
>
>Brad Spengler wrote:
>| Valdis,
>|
>| Please try to stay consistent with your own arguments.  If you 
>defeat
>| them yourself barely into your third paragraph, you don't give 
>me much
>| to do!
>|
>| To summarize:
>|
>|> have any untrusted local users - for instance, my laptop.  The 
>only users
>|> on it are me, myself, and I<, and the guy that owned my 
>webserver, or
>| the guy that owned my email client, or the guy that owned my 
>audio
>| player, or the guy that owned my video player, or the guy that 
>owned my
>| web browser, or the guy that owned my FTP client, or the guy 
>that owned
>| my PDF reader, or the guy that owned my office application>
>|
>| You're a very trusting individual!
>|
>| This is exactly why telling someone to update if they have any
>| "untrusted local users" just doesn't make any sense since it 
>misleads a
>| majority of users.  A better replacement would be "if your 
>machine is
>| network-connected."  How do you own a website if you can't break 
>into it
>| directly?  Find out what other websites are hosted on the same 
>machine,
>| break into one of them, then locally escalate privileges, giving 
>you
>| access to all the websites hosted on the machine.  If you don't 
>think
>| this happens, you've got your head in the sand and honestly 
>should just
>| give up having anything to do with security.
>|
>| -Brad
>|
>| -------------------------
>|
>| _______________________________________________
>| Dailydave mailing list
>| Dailydave@...ts.immunitysec.com
>| http://lists.immunitysec.com/mailman/listinfo/dailydave

--
Click for quotes on adjustable mortgages.
http://tagline.hushmail.com/fc/Ioyw6h4dOB3vJ6t2RHYfNNcMAdZxCoaJvTLB636Im56JbXVJrQ7UIQ/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists