Date: Fri, 19 Mar 2021 10:43:11 -0400 From: Brad Spengler <spender@...ecurity.net> To: oss-security@...ts.openwall.com Subject: Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS Hi Sasha, I'm sorry, but I can't let this email demonstrating a complete lack of self-awareness go without comment. > I suppose we can't *require* them, but it's a matter of curtesy, right? > They already have that information, and instead of making a bunch of > other people do the same job they could just share the information to > begin with. I'm seriously baffled that you could type those words out with a straight face. As we know happens often, including with the recent iSCSI vulnerabilities, upstream has intentionally omitted CVE information from kernel commit messages -- in other words: "they already have the information, and instead of making a bunch of other people do the same job they could just share the information to begin with." Do none of you understand at all that the problems that exist are entirely of your own creation? Neither you nor Greg ever come to this list with announcements of your own. That you have to endure a tiny fraction of what the rest of the world is inflicted with from your intentional actions -- sorry, you are not the victims here, and it's completely ridiculous to paint yourselves as one. Greg started his tirade yesterday with a false assumption that the stable kernels had already fixed the one issue August of last year. That was not true (stable kernels < 5.7 were all missing the fix). Then he claimed SuSE didn't bother to backport the fix. That was not true: https://github.com/SUSE/kernel/commit/b93bddd7ae24aa8ebe48d13dcff4011a34861482 If you guys want to complain about bad information, leaving it out of useless snarky replies would be a good start. > Exactly, they already must have this information, which is where some of > the frustration around these notifications comes from: it reads as > nothing more than a lip service. You're assuming too much -- it's quite clearly someone new at RH doing these recent advisories. Thanks, -Brad Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.