[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240329221938.dqit6xuh4es2v6gc@awork3.anarazel.de>
Date: Fri, 29 Mar 2024 15:19:38 -0700
From: Andres Freund <andres@...razel.de>
To: oss-security@...ts.openwall.com
Subject: Re: Re: backdoor in upstream xz/liblzma leading to
ssh server compromise
Hi,
On 2024-03-29 21:54:11 -0000, Tavis Ormandy wrote:
> On 2024-03-29, Solar Designer wrote:
> >> I have a minor procedural question for Solar though, shouldn't this
> >> have been redirected to oss-security immediately from distros? What's
> >> the rationale for an embargo here?
> >
> > We don't have a clear policy for such case. Some distros list members
> > have indeed suggested making this public ASAP. We ended up delaying
> > publication by one day per my suggestion (as a compromise between ASAP
> > and having no specific CRD), and I think these are some reasons why:
>
> Thanks, a compromise is better than nothing :) I think I would have
> argued for immediately discussing this in the open.
FWIW, I don't know much of the tradeoffs in this space. With that caveat:
Personally I would have felt quite hesitant to post to distros@ if I knew that
distros wouldn't get a reasonable, small, amount of time to prepare, so they
have fixed packages available at the time of the public posting.
> > 2. We didn't know how the culprit (or group) would react when they
> > learned of the full extent of the community's awareness.
>
> This is true with any vulnerability, there is always the possibility an
> attacker is already aware of it. They could respond to a patch being
> released by trying to extract as much value from their exploit before
> it's worthless.
>
> I'm not convinced that's a good argument to delay making the patch
> available?
What patch? You mean going back to an older version?
Greetings,
Andres Freund
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
