[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170622002605.e4sfvdxi2hugl6o7@dojo.mi.org>
Date: Wed, 21 Jun 2017 20:26:05 -0400
From: "Mike O'Connor" <mjo@...o.mi.org>
To: oss-security@...ts.openwall.com
Subject: Re: Qualys Security Advisory - The Stack Clash
:Still, if OpenBSD was able to resolve the issues necessary after
:notification without leaking full details to the public, shouldn't
:this have been possible for the other projects without an embargo,
Several open-source distros fixing the same flavor of issue in the
same timeframe might've raised suspicions in a way that one distro
alone wouldn't have. Heck, I've tracked down embargoed security
issues just from what multiple closed source vendors documented in
their release notes.
:My take on the embargoing process (outside of what's already mentioned
:on https://grsecurity.net/an_ancient_kernel_hole_is_not_closed.php ):
:I've always been concerned by the fact that smaller distros seem to
:be barred from distros-list membership; it seems the arrangement
:lends itself too much to enabling the marketing of the larger
:companies and in fact perhaps even disincentivizing their investment
:in security as the embargo process enables them to skirt much of the
:public pain they'd otherwise have to experience (for in this
:instance what was a completely avoidable problem). I get the practical
:reasons for the policy (increased leak risk, major distros often do
:the actual fixing work, etc) but from a level of principle it's always
:rubbed me the wrong way.
In the past, I've proposed that the embargo mailing list archives
themselves have an "embargo", after which they become public. That
way, there's after-the-fact transparency, and it gives the folks who
care a good idea of what happened. Is there anything sensitive at
this point in, say, the March 2017 linux-distros archives??
-Mike
--
Michael J. O'Connor mjo@...o.mi.org
=--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
"Well done is better than well said." -Ben Franklin
Download attachment "signature.asc" of type "application/pgp-signature" (188 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
