linux-kernel - Re: [PATCH] Documentation/security-bugs: provide more information about linux-distros

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sun, 14 Jul 2019 20:05:55 +0200
From:   Solar Designer <solar@...nwall.com>
To:     Sasha Levin <sashal@...nel.org>
Cc:     Will Deacon <will@...nel.org>,
        Greg KH <gregkh@...uxfoundation.org>, corbet@....net,
        keescook@...omium.org, peterz@...radead.org, tyhicks@...onical.com,
        linux-doc@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Documentation/security-bugs: provide more information about linux-distros

On Thu, Jul 11, 2019 at 04:35:00PM -0400, Sasha Levin wrote:
> On Thu, Jul 11, 2019 at 06:09:21PM +0100, Will Deacon wrote:
> >On Thu, Jul 11, 2019 at 07:07:32PM +0200, Greg KH wrote:
> >>On Thu, Jul 11, 2019 at 12:36:37PM -0400, Sasha Levin wrote:
> >>> Provide more information about how to interact with the linux-distros
> >>> mailing list for disclosing security bugs.
> >>>
> >>> First, clarify that the reporter must read and accept the linux-distros
> >>> policies prior to sending a report.
> >>>
> >>> Second, clarify that the reported must provide a tentative public
> >>> disclosure date and time in his first contact with linux-distros.
> >>>
> >>> Suggested-by: Solar Designer <solar@...nwall.com>
> >>> Signed-off-by: Sasha Levin <sashal@...nel.org>
> >>> ---
> >>>  Documentation/admin-guide/security-bugs.rst | 21 +++++++++++++--------
> >>>  1 file changed, 13 insertions(+), 8 deletions(-)

Thanks.  Sasha's proposed changes do address the two issues I pointed
out, so are an improvement.  However:

> >>Do we really need to describe all of the information on how to use the
> >>distro list here?  That's why we included the link, as it has all of
> >>this well spelled out and described.  If anything, I would say we should
> >>say less in this document about what linux-distros do, as that is
> >>independent of the Linux security team.
> >
> >Agreed, and it also means that any changes linux-distros make to their
> >policy won't be reflecting in the numerous kernel trees out there, so a
> >link is much better imo.

I also agree with this.

> I agree that the 2nd part about embargo timelines is redundant, but I
> only addressed it because the document was already addressing embargos.
> 
> I only now realized that the link we had there was just going to the
> main wiki page by mistake: the tag it was trying to point to was removed
> from the wiki page. We should probably update that too.
> 
> With regards to the explicit instruction to agree with policies, I think
> we do need it there. Right now this section reads as "for embargoes work
> with linux-distros@...openwall.org, and btw they have a wiki which you
> may or may not need to read".

Yes, we should update the link, but maybe we should also drop the
posting e-mail address, which will ensure someone will have to check out
the link before they're able to post.  This should allow us to drop the
summary of linux-distros policy and posting instructions, although maybe
they're beneficial to keep if we're confident we'd be maintaining this
summary to reflect possible changes on the linked page.

> We probably do need to stress here that linux-distros has different
> policies than security@...nel.org.

OK.

Alexander