Re: thoughts on kernel security issues

[Alan Cox <alan@lxorguk.ukuu.org.uk>]

On Gwe, 2005-01-14 at 22:51, Linus Torvalds wrote:
> Sure, you can do that, and if you do that, then the world recognizes you 
> for what you are - nothing but a publicity-seeking creep.

And what does that make writing your own operating system ? Some of the
security folks are publicity seekers, others see it as an investment
against getting a job by becoming known. Quite a few we deal with a
large professional organisations who don't need publicity and actually
the more interesting bodies often don't *want* publicity just to ensure
that all their vendors have fixes before things go public and that their
government infrastructure and nation state will be best served. 

> THAT is why vendor-sec is bad. It allows publicity-seeking creeps to take 
> on the mantle of being "good".

They don't agree with you, nor do the economists I'm afraid.

> I'm arguing for exposing them for what they are. If that hurts some 
> feelings, tough ;)

Its ok I'm sure they think you are an arrogant clueless jerk 8)

> It's not a one- or two-week delay. Once the vendor-sec mentality takes 
> effect, the delay inevitably grows. You _always_ have excuses for 
> delaying, and as shown by this thread, a _lot_ of people believe them.

The "vendor-sec" mentality - from someone who has never been involved in
it. Ah yes Linus you might want to consider writing articles for a local
newspaper you appear to have the right qualifications for it 8)

vendor-sec has a lot of people on it who don't like long non-disclosure
periods and get quite annoyed when they happen out of our control (eg
CERT originated notifications). 

Alan