Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 29 Mar 2024 22:00:40 -0400
From: Marc Deslauriers <>
Subject: Re: Re: backdoor in upstream xz/liblzma leading to ssh
 server compromise

On 2024-03-29 19:49, Russ Allbery wrote:
> Marc Deslauriers <> writes:
>> I would argue against having a policy requiring something like this to
>> be made public immediately. The important thing here is to do whatever
>> it takes to make sure users are secure as fast as possible, not expose
>> them to even bigger attack surface with no mitigation available.
> There is an interesting potential disagreement of interests here, too, in
> that one's ability to respond to a disclosed vulnerability with no
> available updated packages is heavily resource-dependent.  Large
> (security-savvy) companies may reasonably prefer disclosure as early as
> possible because they have in-house security teams that follow lists like
> this and are capable of taking immediate action in advance of a general
> fix.  However, smaller organizations or individuals who are reliant on
> distributions for notification and patches are potentially more vulnerable
> to any increased attacker activity that might happen due to the public
> announcement and before the availability of updated packages.
> That gap could be closed somewhat by distributions sending immediate
> security alerts with mitigations and workarounds once the issue becomes
> public and then following up with alerts once patches are available, at
> the cost of an obvious increase in work and stress for distributions (and
> possible contention of resources between putting out a migitation alert
> and preparing a proper fix).
> (Disclosure: I am a member of the Debian project, but I am not a member of
> the Debian security team and am speaking solely for myself here.)

The large security-savvy companies I deal with have no interest in getting 
0-days dropped on them and are advocating for longer embargoes with 
pre-notifications to which we have been pushing back.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.