Date: Tue, 23 Nov 2010 15:06:14 -0500 From: Dan Rosenberg <dan.j.rosenberg@...il.com> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: Linux kernel address leaks > I think that the only way to support your goal is to make the case that > the CVE definition does cover such exposures. In my opinion it > certainly does; although at the lowest possible severity. > > The best course of action is to ask for the assignments, and perhaps > Steve Christey will clarify. That's not "blackmail" or anything > nefarious, that's simply the proper procedure for disclosing a > security-relevant issue. > Fair enough - while the primary goal of my email was to bring about a discussion of these issues, I can see how CVE assignments might further the cause, so to speak. Steve, what is your take on all this? > For those that are against increased CVE assignments due to the > inevitable sensational "high bug count journalism", get over it. > Realize that the people that do this simply do not recognize the hidden > factors at play and the fact that quantity does not equal quality. > They're a lost cause. > > Oh, and Dan, don't get discouraged so easily. You're tackling a hard > problem (well, a technically straightforward problem, but a hard > social problem). You're bound to run into barriers simply due to human > nature. If it were easy it would already be done. Thanks Mike. One of the reasons I posted this here was that previously, I felt as if I were fighting a one-man, futile battle against the kernel devs. It's obvious to me that plenty of people not actively involved in kernel development who care about these kinds of security issues, and it's those opinions I want to bring to the table. -Dan
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.