Re: thoughts on kernel security issues

[Marcelo Tosatti <marcelo.tosatti@cyclades.com>]

On Wed, Jan 12, 2005 at 11:01:42AM -0800, Linus Torvalds wrote:
> 
> 
> On Wed, 12 Jan 2005, Greg KH wrote:
> > 
> > So you would be for a closed list, but there would be no incentive at
> > all for anyone on the list to keep the contents of what was posted to
> > the list closed at any time?  That goes against the above stated goal of
> > complying with RFPolicy.
> 
> There's already vendor-sec. I assume they follow RFPolicy already. If it's 
> just another vendor-sec, why would you put up a new list for it?
> 
> In other words, if you allow embargoes and vendor politics, what would the 
> new list buy that isn't already in vendor-sec.
> 
> When I saw how vendor-sec worked, I decided I will never be on an embargo 
> list. Ever. That's not to say that such a list can't work - I just 
> personally refuse to have anything to do with one. Whether that matters or
> not is obviously an open question.

Of course it matters Linus - vendors need time to prepare their updates. You 
can't ignore that, and you can't "have nothing to do with it". 

You seem to dislike the way embargos have been done on vendorsec, fine. They can
be done on a different way, but you have to understand that you and Andrew
need to follow and agree with the embargo.

How you feel about having short fixed time embargo's (lets say, 3 or 4 days) ? 

The only reason for this is to have "time for the vendors to catch up", which 
can be defined by the kernel security office. Nothing more - no vendor politics
involved.

It is a simple matter of synchronization.