[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <01322afdcf6b4dd7b81452dc5afed6b1@amazon.com>
Date: Fri, 29 Mar 2024 22:59:11 +0000
From: "Liguori, Anthony" <aliguori@...zon.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: Re: backdoor in upstream xz/liblzma leading to ssh
server compromise
On 2024-03-29, Andres Freund wrote:
> Hi,
>
> On 2024-03-29 21:54:11 -0000, Tavis Ormandy wrote:
>> On 2024-03-29, Solar Designer wrote:
>> >> I have a minor procedural question for Solar though, shouldn't this
>> >> have been redirected to oss-security immediately from distros? What's
>> >> the rationale for an embargo here?
>> >
>> > We don't have a clear policy for such case. Some distros list members
>> > have indeed suggested making this public ASAP. We ended up delaying
>> > publication by one day per my suggestion (as a compromise between ASAP
>> > and having no specific CRD), and I think these are some reasons why:
>>
>> Thanks, a compromise is better than nothing :) I think I would have
>> argued for immediately discussing this in the open.
>
> FWIW, I don't know much of the tradeoffs in this space. With that caveat:
I think we should have a policy that if issues are suspected to be actively exploited, that the issue goes public immediately. If even there is no patch or mitigation, there's not a lot of benefit to keeping it private.
I think everyone was acting in good faith here and did great work, but there wasn't a clear policy for handling this type of issue.
I very much agree that there's very little benefit to limiting the number of folks that know what's going on when someone is actively taking advantage of an issue.
Regards,
Anthony Liguori
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
