[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <ZY2_KYCRMCjlL9ED@itl-email>
Date: Thu, 28 Dec 2023 13:32:07 -0500
From: Demi Marie Obenour <demi@...isiblethingslab.com>
To: oss-security@...ts.openwall.com
Subject: Re: linux-distros membership application of openEuler
On Thu, Dec 28, 2023 at 10:31:42AM +0000, Greg KH wrote:
> On Tue, Dec 26, 2023 at 01:35:55AM +0100, Solar Designer wrote:
> > On Tue, Dec 26, 2023 at 12:38:36AM +0100, Steffen Nurpmeso wrote:
> > > and i really today stumbled over his funny opinion
> > >
> > > . All "early notice" lists are leaks and should be considered
> > > public.
> > > . Unless your project is not used by anyone.
> > > . Otherwise, why would your government allow it to exist?
> >
> > I think Greg's stance on this is inconsistent, if we also recall his
> > preference against full public disclosure of issues discussed on private
> > lists and his running of private lists on CPU microarchitectural issues.
>
> As you are referring to my talk here, I figured I would point out that
> later on in it I do talk explicitly about the private lists that we run
> for these CPU issues and how much we hate them. Companies who are
> currently not on these lists are actively trying to circumvent them to
> get access to the information on them, despite all of the lawyers and
> governments involved agreeing that this is the best and only way we know
> how to handle these types of issues at the moment.
>
> In other words, I hate them, companies hate them, and governments hate
> them, but no one involved has solid ideas of what to do instead.
Change the incentives so that CPU vendors decide to produce CPUs that
don't have bugs, and therefore the lists aren't needed?
I'm not sure if this is practical, but if it is, it would solve the
problem. I also am not sure what the unintended consequences would be.
Mandating Speculative Taint Tracking would get rid of the speculative
execution vulnerabilities, assuming that it is implemented correctly.
> "Luckily" I think that laws like the CRA are going to make them obsolete
> in a few years time so maybe that will cause them to go away as I don't
> see any end of CPU bugs happening before then.
>
> > However, the concern about leaks is valid. I think the most effective
> > defense we have is the 14 days maximum embargo time, which removes the
> > data's long-term value for potential use in attacks.
>
> Again, I still consider this a form of blackmail against open source
> projects when you do this, but hey, you do you :)
--
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
