[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <875603C9-F2F1-4D25-A081-503D870A5FEB@shub-internet.org>
Date: Fri, 24 Jul 2015 16:31:44 -0500
From: Brad Knowles <brad@...b-internet.org>
To: oss-security@...ts.openwall.com
Cc: Brad Knowles <brad@...b-internet.org>
Subject: Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser
On Jul 24, 2015, at 3:46 PM, Leif Nixon <nixon@...ator.liu.se> wrote:
> I may have been somewhat unclear; what I'm (very) upset about is the
> release of a working exploit without giving the user community a
> realistic chance to patch.
Debates over how much to release and when have been with us since the very first security announcement, and they trace their lineage back to the history of physical security going back thousands of years.
There will always be people who get their panties in a major twist because they feel that too much information was released too soon, and there will always be people who get their panties in a major twist because not enough information was released soon enough.
In this day and age, we have the CRD process. Official representatives from both Qualys and Red Hat have spoken about their perspective on the matter, and they seem to largely be in agreement.
So, as a private citizen, you have all the right in the world to get your panties in a major twist because of some huge flaws that you find in the CRD process and how it was executed. Just like every other private citizen who may have something to say on that topic.
However, this list is not the proper place to have that flamewar.
If you really feel that strongly about it, I suggest that you find the proper place to have a discussion about what CRD really means and how that should be executed. If you can actually help that process to become better, I’m sure that most of the involved parties will welcome your participation.
Just keep in mind that this list is not that place.
--
Brad Knowles <brad@...b-internet.org>
LinkedIn Profile: <http://tinyurl.com/y8kpxu>
Download attachment "signature.asc" of type "application/pgp-signature" (833 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
