full-disclosure - Re: Mr. Magorium's Wunderbar Emporium

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <33650.1250282953@turing-police.cc.vt.edu>
Date: Fri, 14 Aug 2009 16:49:13 -0400
From: Valdis.Kletnieks@...edu
To: spender@...ecurity.net (Brad Spengler)
Cc: full-disclosure@...ts.grok.org.uk, dailydave@...ts.immunitysec.com
Subject: Re: Mr. Magorium's Wunderbar Emporium

On Fri, 14 Aug 2009 14:53:06 EDT, Brad Spengler said:
> "Congrats" Linus on screwing over all the vendors and every Linux user
> by forcing disclosure of the bug before vendors could ship out updated
> kernels.  Your patch applies well to their binary packages.

Poor Linus can't catch a break.  Just like 3 weeks ago some guy named
Brad Spengler was ripping him a new one:

  "(Really there should have been a CVE for the lack of 
  -fno-delete-null-pointer-checks instead of pretending the only problem 
  was /dev/net/tun.  As the commit to add it showed (and at least 10 other 
  commits to the kernel this weekend) lots of other code was affected, so 
  someone not applying a fix for a CVE mentioning only /dev/net/tun 
  because they don't have the code for /dev/net/tun compiled in, is going 
  to be missing out on a number of fixes)."

Of course, getting a CVE for that issue would have forced disclosure of the bug
too, quite possibly before the vendors were ready to ship updated kernels.
In general, you *can't* have both "flag fixes as security issues right up
front before vendors have a chance to backport" and "don't screw over the
vendors and users".

So how do you suggest that Linus could have handled this in a manner that
didn't screw over vendors and users?

Out of curiosity, did *you* did your due diligence and didn't release that
exploit until you had verified that all the vendors had updated kernels ready
to ship? :)

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/