oss-security - Re: Who named shellshock?

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20141007022828.GA2200@openwall.com>
Date: Tue, 7 Oct 2014 06:28:28 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Who named shellshock?

Florian,

On Mon, Oct 06, 2014 at 02:04:42PM -0700, Michal Zalewski wrote:
> I don't think it happened on Twitter - using advanced search with date
> ranges, I don't see any mentions that would predate this article,
> which already seems to be using the term:
> 
> http://www.csoonline.com/article/2687265/application-security/remote-exploit-in-bash-cve-2014-6271.html
> 
> It's odd that an article posted at 8 AM on Sept 24 would have any idea
> of how the bug is already being called by the security community,
> especially ahead of any Twitter buzz. But both Stephane and Florian
> implied that some of the pre-notified parties apparently started
> leaking details to the press and were getting ready to make a splash
> the moment it goes public, so maybe that's the explanation.

I don't know who coined the Shellshock name, but I'd like us to know
whether there was in fact a leak, and when.  (Luckily, I know it
couldn't have been from the distros list, because no detail was posted
to the distros list, thanks!)  I had raised this concern here:

http://www.openwall.com/lists/oss-security/2014/09/24/36

It is insufficient that "it was an honest mistake" and that "apologies
were made and accepted."

I have no intent to place blame, but at least the general public needs
to know whether the information got to the press before or after the
scheduled coordinated public disclosure date/time ("Wednesday,
2014-09-24 14:00 UTC").  If it's before, then this qualifies as a leak.
If it's after, then it does not.

The article has "Sep 24, 2014 8:35 AM PT" on it, which is 15:35 UTC.
Did the article's author receive the information before or after 14:00,
and when exactly?

NB: Please do not provide any information on this to me in private.
If you're able to address my question, please do so on the list.

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.