linux-kernel - Re: [stable] Linux 2.6.25.10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.1.10.0807151716510.2867@woody.linux-foundation.org>
Date:	Tue, 15 Jul 2008 17:24:20 -0700 (PDT)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	pageexec@...email.hu
cc:	Greg KH <greg@...ah.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, stable@...nel.org
Subject: Re: [stable] Linux 2.6.25.10

On Wed, 16 Jul 2008, pageexec@...email.hu wrote:
> 
> we went through this and you yourself said that security bugs are *not*
> treated as normal bugs because you do omit relevant information from such
> commits

Actually, we disagree on one fundamental thing. We disagree on 
that single word: "relevant".

I do not think it's helpful _or_ relevant to explicitly point out how to 
tigger a bug. It's very helpful and relevant when we're trying to chase 
the bug down, but once it is fixed, it becomes irrelevant.

You think that explicitly pointing something out as a security issue is 
really important, so you think it's always "relevant". And I take mostly 
the opposite view. I think pointing it out is actually likely to be 
counter-productive.

For example, the way I prefer to work is to have people send me and the 
kernel list a patch for a fix, and then in the very next email send (in 
private) an example exploit of the problem to the security mailing list 
(and that one goes to the private security list just because we don't want 
all the people at universities rushing in to test it). THAT is how things 
should work.

Should I document the exploit in the commit message? Hell no.  It's 
private for a reason, even if it's real information. It was real 
information for the developers to explain why a patch is needed, but once 
explained, it shouldn't be spread around unnecessarily.

			Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/