full-disclosure - Re: Port Randomization: New revision of our IETF Internet-Draft

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <43513.1220307806@turing-police.cc.vt.edu>
Date: Mon, 01 Sep 2008 18:23:26 -0400
From: Valdis.Kletnieks@...edu
To: rholgstad <rholgstad@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Port Randomization: New revision of our IETF
	Internet-Draft

On Mon, 01 Sep 2008 15:51:35 CDT, rholgstad said:
> Linus doesn't care about security

No, he actually *does* care about security - he's just pf the opinion
that security fixes don't automatically rate a 'ZOMG! PWNED!' flag on
them like certain *BSD variants think.  He thinks that sticking a big
SECURITY PATCH tag on a fix tends to make people cherry-pick and install
just those fixes - even though the patch they *didn't* install that
fixes a system crash or a silent data corruption is actually more critical.

Your chances of getting it accepted improve greatly if you have a nice
writeup of *why* the patch is a good idea - summarize the current
state, explain how the new version works, list what attacks it minimizes.
Oh - and I *guarantee* that somebody will make a (quite valid) issue about
the drain on the /dev/random entropy pool if you're using that as your
(possibly indirect) source of random bits.   You may want to make sure
that you have either Kconfig magic for compile time selection, and/or
a /sys file or something for runtime tweaking.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/