[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 23 Nov 2010 15:06:14 -0500
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: Linux kernel address leaks
> I think that the only way to support your goal is to make the case that
> the CVE definition does cover such exposures. In my opinion it
> certainly does; although at the lowest possible severity.
>
> The best course of action is to ask for the assignments, and perhaps
> Steve Christey will clarify. That's not "blackmail" or anything
> nefarious, that's simply the proper procedure for disclosing a
> security-relevant issue.
>
Fair enough - while the primary goal of my email was to bring about a
discussion of these issues, I can see how CVE assignments might
further the cause, so to speak. Steve, what is your take on all this?
> For those that are against increased CVE assignments due to the
> inevitable sensational "high bug count journalism", get over it.
> Realize that the people that do this simply do not recognize the hidden
> factors at play and the fact that quantity does not equal quality.
> They're a lost cause.
>
> Oh, and Dan, don't get discouraged so easily. You're tackling a hard
> problem (well, a technically straightforward problem, but a hard
> social problem). You're bound to run into barriers simply due to human
> nature. If it were easy it would already be done.
Thanks Mike. One of the reasons I posted this here was that
previously, I felt as if I were fighting a one-man, futile battle
against the kernel devs. It's obvious to me that plenty of people not
actively involved in kernel development who care about these kinds of
security issues, and it's those opinions I want to bring to the table.
-Dan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
