[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 31 Jan 2014 05:07:44 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: responsible use of distros and linux-distros lists (was: Linux kernel: fs: fix get_dumpable() incorrect tests (CVE-2013-2929))
On Fri, Jan 31, 2014 at 04:51:55AM +0400, Solar Designer wrote:
> I'm afraid the issue below was never brought to oss-security (as it must
> have been). The fix was committed on November 13:
>
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d049f74f2dbe71354d43d393ac3a188947811348
>
> including detailed description and the CVE-2013-2929 reference. So it
> was clearly disclosed as a security issue, yet bringing it to
> oss-security specifically seems to have falled through the cracks. :-(
Unfortunately, I was not watching closely enough to notice this did
not(?) get to oss-security in time, so we got a nasty violation of
linux-distros list policy here. Can those distros and linux-distros
members who would like the lists to stay around please help police the
lists, detecting and correcting such instances of negligence much
sooner? Thanks!
Timely posting to oss-security (yes, this one specific place) is
important, because that way a distro (or anyone) who chooses not to join
linux-distros (or distros, as appropriate) or is not accepted may
nevertheless be confident they receive info on all the same issues once
the issues are publicly disclosed, by being subscribed to oss-security.
Fire-and-forget use of distros and linux-distros lists is inappropriate.
By posting to one of these lists, you accept certain responsibility:
http://oss-security.openwall.org/wiki/mailing-lists/distros#how-to-use-the-lists
"When the security issue is finally to be made public, it is your (the
original reporter's) responsibility to post about it to oss-security
(indeed, you and others may also post to any other mailing lists, etc.)"
If you're unwilling to accept that responsibility, please refrain from
posting to those lists.
Unfortunately, people sometimes don't read or ignore or forget about
this requirement, or forget that they have sent something to the distros
or linux-distros lists but not yet to oss-security - so let's be
watching and reminding! (Or maybe we should automate the reminders.
Or maybe we should automate the public disclosure. Or maybe we should
shutdown the lists.)
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
