linux-kernel - Re: [stable] Linux 2.6.25.10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 15 Jul 2008 18:08:11 -0700 (PDT)
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	pageexec@...email.hu
cc:	Greg KH <greg@...ah.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, stable@...nel.org
Subject: Re: [stable] Linux 2.6.25.10

On Wed, 16 Jul 2008, pageexec@...email.hu wrote:
> 
> > And I take mostly the opposite view. I think pointing it out is
> > actually likely to be counter-productive. 
> 
> you keep saying that, but you don't explain *why*.
> 
> > For example, the way I prefer to work is to have people send me and the 
> > kernel list a patch for a fix, and then in the very next email send (in 
> > private) an example exploit of the problem to the security mailing list 
> > (and that one goes to the private security list just because we don't want 
> > all the people at universities rushing in to test it). THAT is how things 
> > should work.
> 
> fine with me, i wasn't talking about that at all though ;).

Oh, so now you're suddenly fine with not doing "full disclosure"?

Just a few emails ago you berated me for not doing full disclosure, but 
now you're saying it is fine?

Can you now admit that it's a gray line, and that we just have very 
different opinions of where the line is drawn?

> 1. simple words/phrases that one can grep for (mentally or automated)
>    examples: 'security', 'exploitable', 'DoS', 'buffer overflow', etc

I literally draw the line at anything that is simply greppable for. If 
it's not a very public security issue already, I don't want a simple "git 
log + grep" to help find it.

That said, I don't _plan_ messages or obfuscate them, so "overflow" might 
well be part of the message just because it simply describes the fix. So 
I'm not claiming that the messages can never help somebody pinpoint 
interesting commits to look at, I'm just also not at all interested in 
doing so reliably.

> i believe 3-5 are definitely not commit message material. 1 or 2 are.
> 5 should never be published or disseminated, 3 and 4 may be distributed
> to interested parties.

And I believe you now at least understand the difference. I draw the line 
between 0 and 1, where 0 is "explain the fix" - which is something that 
any - and every - commit message should do.

			Linus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/