[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 3 Mar 2011 17:59:08 -0800
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: Vendor-sec hosting and future of closed lists
On Thu, Mar 03, 2011 at 08:11:00PM -0500, Michael Gilbert wrote:
> On Thu, 3 Mar 2011 16:41:07 -0800 Greg KH wrote:
> > On Thu, Mar 03, 2011 at 07:26:21PM -0500, Dan Rosenberg wrote:
> > > Of course failing to anticipate security impact is bound to happen in
> > > the kernel; it frequently happens in userland too, and is unavoidable.
> > > That doesn't mean we can't try, and it doesn't mean we should be
> > > overly paranoid and have security folks manually audit every patch.
> > > Currently, maintainers and bug reporters are expected to ask
> > > themselves a simple question when deciding whether or not to CC
> > > stable: "does this fix a bug or security issue, or is it a new
> > > feature?". Similarly, I don't think it's too much to ask for people
> > > to consider the question of "does this bug it allow an unprivileged
> > > user to crash the system, gain additional access, or otherwise cross
> > > privilege boundaries?" And if the answer is "I don't know, maybe?",
> > > then they should CC this list to be safe. I think this would result
> > > in not nearly as much volume as you're anticipating.
> >
> > They do this already today, that's what security@...nel.org is for, and
> > it gets a bit of traffic like this every week.
>
> Is this list open to the public? It doesn't seem to be available on
> http://vger.kernel.org/vger-lists.html.
No, it is closed, as it should be as potential security problems are
mailed there. You don't want that to be totally open, right?
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
