[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 26 Feb 2013 14:05:35 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: Henri Salo <henri@...v.fi>
CC: oss-security@...ts.openwall.com
Subject: Re: CVE request - Linux kernel: VFAT slab-based buffer
overflow
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/26/2013 01:42 PM, Henri Salo wrote:
> On Tue, Feb 26, 2013 at 01:31:59PM -0700, Kurt Seifried wrote:
>> I suspect part of the problem is scale. Most people don't
>> understand the scale at which the Linux Kernel and vendors handle
>> bug fixes and code changes. External people simply see a few
>> poorly handled security related issues and probably think "well
>> how hard can it be to properly a few extra security flaws?" but
>> they don't see that those 5 security issues were buried in 10,000
>> other code fixes. The resources needed to audit every code change
>> for a security impact simply aren't available (and even if we had
>> enough talented people who exactly is going to pay them all?).
>
> Why should they be paid? I'd say problem is that there isn't lots
> of people who understand aspects needed to notice a security
> vulnerability in Linux kernel and it's even more difficult to fix
> it without breaking something else.
>
> Money is not the only thing getting stuff done.
>
> -- Henri Salo
The problem with security is you have to basically do it 100%
correctly 100% of the time, otherwise things fall through the cracks
(like this VFAT thing). That tends to fall outside of what most people
like to do as a hobby. Plus the volume needed, I think you
underestimate how long code reviews take especially with the volume
the Linux Kernel deals with. Hence the need to pay people so when they
spend 40-80 hours a week doing this they can also afford food and whatnot.
I've seen various attempts at crowd sourcing security, it doesn't work
so well for the simple fact that most security people are very busy,
and anyone that shows talent/good work ethic tends to get hired by a
company and get even more busy.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRLSOfAAoJEBYNRVNeJnmT/T4QANo1QYxgNvHI+pRvVR0QIkrZ
94BBnDxf28U6ul0mtlY9aXQK/uDMjjRXvhffLRTOOdmQr/ERj09zLTdw48NgA5SG
HO+3Wwdv+mvSmPyS4z2TiXHMl6A+nxSvUgZnhwmQ1iTbZdFxK5Gd19pb3oSVFF7d
Bb14dE/gXcRhia0NXOoF1pP3JQhaHpX5FNXJv61I56UcFqVM+5ONERHReLCMMD0P
IQTZ0uEWX4TZIRi0UuoOD4lZzxcrLW+CJXuncUsxK+Ii9rEqYOrgshgeXAUfFSuw
ox0BMeSbsSFALxlDJ+BGEvOnP47zM1YRGx6mCXzuUkmXYAhyGK4ByD3vRX1hua9h
RYrpxmEi4v1SlZuI64DIM90OAmaeyDqvieKXQAA197tZ+YPOxeRb2ZSQYSvQ4ciU
WimhedarciDKrghU6jRZzrqRIwf1oUpv+ibg6rjE1LhKurc641omNWGjWG0v6Iuw
o+ZNSIoFxkzje3r0RzIM9EWB9Vix7+wf28zU6Mxt4mKFKw5D7o1rxWN95BJtVAG9
9DGWBFfGUB+/OPhbFrTBGzTdPvbr4JupdPqpdfwmkL3sRHM903a9rZBJ+zcP1mhc
a7WxVpvcwXUGHvO3lvNMEhNZEkla2ZwFYnx+xHWizwWYPcWsz/H6VnH9JEs2T4T/
u7t6vfJcGBGK2vgYf7Wk
=PFow
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
