full-disclosure - Re: Linux's unofficial security-through-coverup policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080717125137.GA20060@grsecurity.net>
Date: Thu, 17 Jul 2008 08:51:37 -0400
From: spender@...ecurity.net (Brad Spengler)
To: A.L.M.Buxey@...ro.ac.uk
Cc: full-disclosure@...ts.grok.org.uk, dailydave@...ts.immunitysec.com
Subject: Re: Linux's unofficial security-through-coverup
	policy

> they have a policy of non-disclosure?  Wierd. Last time I checked
> I couldnt get the source code for Windows, IOS, OSX Intel from
> a repository open to anyone.  and yet those companies have
> a good disclosure policy?

Unless you're a programmer and security "expert", what good does the 
source do you?  You know a subset of these same people can bindiff a 
MS patch as well and determine the vulnerability on their own without 
any source, right?  Your argument only applies if every user of Linux 
was a programmer and security expert, so is therefore useless in 
reality.

> I dont get your point. You want them
> to specifically state how a vulnerability might actually
> WORK and even give you some example code to make your life easier?

That's not at all what we're saying.  That thing I said to Valdis about 
actually reading the links before replying, there's a reason for it.  I 
know in this day and age of pseudo-intellectualism, you want to think 
you can skim through some posts for five minutes so you can feel like an 
expert on the subject, but seriously, read what was linked and then you 
wouldn't ask such ignorant questions.  There's a lot of information in 
there that you couldn't possibly know, as I've pasted several messages 
and quotes from their private vendor-sec and kernel-sec mailing lists 
(which I don't think you're on).

To answer your immediate question, you could have read several of the 
postings, including:
http://marc.info/?l=linux-kernel&m=121616990509661&w=2

If you don't care enough about the subject to actually research it, why 
bother with a kneejerk reply?

-Brad

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/