[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <87r0fsiop6.fsf@hope.eyrie.org>
Date: Fri, 29 Mar 2024 16:49:09 -0700
From: Russ Allbery <eagle@...ie.org>
To: oss-security@...ts.openwall.com
Subject: Re: Re: backdoor in upstream xz/liblzma leading to
ssh server compromise
Marc Deslauriers <marc.deslauriers@...onical.com> writes:
> I would argue against having a policy requiring something like this to
> be made public immediately. The important thing here is to do whatever
> it takes to make sure users are secure as fast as possible, not expose
> them to even bigger attack surface with no mitigation available.
There is an interesting potential disagreement of interests here, too, in
that one's ability to respond to a disclosed vulnerability with no
available updated packages is heavily resource-dependent. Large
(security-savvy) companies may reasonably prefer disclosure as early as
possible because they have in-house security teams that follow lists like
this and are capable of taking immediate action in advance of a general
fix. However, smaller organizations or individuals who are reliant on
distributions for notification and patches are potentially more vulnerable
to any increased attacker activity that might happen due to the public
announcement and before the availability of updated packages.
That gap could be closed somewhat by distributions sending immediate
security alerts with mitigations and workarounds once the issue becomes
public and then following up with alerts once patches are available, at
the cost of an obvious increase in work and stress for distributions (and
possible contention of resources between putting out a migitation alert
and preparing a proper fix).
(Disclosure: I am a member of the Debian project, but I am not a member of
the Debian security team and am speaking solely for myself here.)
--
Russ Allbery (eagle@...ie.org) <https://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
