[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2023122830-stopwatch-sierra-7cf0@gregkh>
Date: Thu, 28 Dec 2023 10:31:42 +0000
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: linux-distros membership application of openEuler
On Tue, Dec 26, 2023 at 01:35:55AM +0100, Solar Designer wrote:
> On Tue, Dec 26, 2023 at 12:38:36AM +0100, Steffen Nurpmeso wrote:
> > and i really today stumbled over his funny opinion
> >
> > . All "early notice" lists are leaks and should be considered
> > public.
> > . Unless your project is not used by anyone.
> > . Otherwise, why would your government allow it to exist?
>
> I think Greg's stance on this is inconsistent, if we also recall his
> preference against full public disclosure of issues discussed on private
> lists and his running of private lists on CPU microarchitectural issues.
As you are referring to my talk here, I figured I would point out that
later on in it I do talk explicitly about the private lists that we run
for these CPU issues and how much we hate them. Companies who are
currently not on these lists are actively trying to circumvent them to
get access to the information on them, despite all of the lawyers and
governments involved agreeing that this is the best and only way we know
how to handle these types of issues at the moment.
In other words, I hate them, companies hate them, and governments hate
them, but no one involved has solid ideas of what to do instead.
"Luckily" I think that laws like the CRA are going to make them obsolete
in a few years time so maybe that will cause them to go away as I don't
see any end of CPU bugs happening before then.
> However, the concern about leaks is valid. I think the most effective
> defense we have is the 14 days maximum embargo time, which removes the
> data's long-term value for potential use in attacks.
Again, I still consider this a form of blackmail against open source
projects when you do this, but hey, you do you :)
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
