[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4806be35-4fb7-4852-9f3b-1bc26663991a@canonical.com>
Date: Fri, 29 Mar 2024 22:00:40 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: backdoor in upstream xz/liblzma leading to ssh
server compromise
On 2024-03-29 19:49, Russ Allbery wrote:
> Marc Deslauriers <marc.deslauriers@...onical.com> writes:
>
>> I would argue against having a policy requiring something like this to
>> be made public immediately. The important thing here is to do whatever
>> it takes to make sure users are secure as fast as possible, not expose
>> them to even bigger attack surface with no mitigation available.
>
> There is an interesting potential disagreement of interests here, too, in
> that one's ability to respond to a disclosed vulnerability with no
> available updated packages is heavily resource-dependent. Large
> (security-savvy) companies may reasonably prefer disclosure as early as
> possible because they have in-house security teams that follow lists like
> this and are capable of taking immediate action in advance of a general
> fix. However, smaller organizations or individuals who are reliant on
> distributions for notification and patches are potentially more vulnerable
> to any increased attacker activity that might happen due to the public
> announcement and before the availability of updated packages.
>
> That gap could be closed somewhat by distributions sending immediate
> security alerts with mitigations and workarounds once the issue becomes
> public and then following up with alerts once patches are available, at
> the cost of an obvious increase in work and stress for distributions (and
> possible contention of resources between putting out a migitation alert
> and preparing a proper fix).
>
> (Disclosure: I am a member of the Debian project, but I am not a member of
> the Debian security team and am speaking solely for myself here.)
>
The large security-savvy companies I deal with have no interest in getting
0-days dropped on them and are advocating for longer embargoes with
pre-notifications to which we have been pushing back.
Marc.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
