| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <487D2371.10258.1BDBBC00@pageexec.freemail.hu> Date: Tue, 15 Jul 2008 22:23:45 +0200 From: pageexec@...email.hu To: Linus Torvalds <torvalds@...ux-foundation.org> CC: Greg KH <greg@...ah.com>, Andrew Morton <akpm@...ux-foundation.org>, linux-kernel@...r.kernel.org, stable@...nel.org Subject: Re: [stable] Linux 2.6.25.10 On 15 Jul 2008 at 13:18, Linus Torvalds wrote: > > > On Tue, 15 Jul 2008, pageexec@...email.hu wrote: > > > > in any case, i don't see why you can't put keywords into the commit > > that say the bug being fixed is 'security related' or 'potentially > > exploitable', etc. people can then decide how to prioritize them. > > Because I see no point. Quite often, we don't even realize some random bug > could have been a security issue. > > It's not worth my energy, in other words. i understand and i think noone expects that. in fact, i know how much expertise and time it takes to determine that. but what happens when you do figure out the security relevance of a bug during bug submission (say, it goes directly to security@...nel.org with a PoC to trigger it) or while working out the fix or you see that it falls into an well-known exploitable bug class? you have the information yet you still make no mention of it. *that* at least can be fixed, if you chose so. cheers, PaX Team -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists