Re: thoughts on kernel security issues

[Greg KH <greg@kroah.com>]

On Wed, Jan 12, 2005 at 10:05:34AM -0800, Linus Torvalds wrote:
> 
> 
> On Wed, 12 Jan 2005, Chris Wright wrote:
> >
> > This same discussion is taking place in a few forums.  Are you opposed to
> > creating a security contact point for the kernel for people to contact
> > with potential security issues?  This is standard operating procedure
> > for many projects and complies with RFPolicy.
> 
> I wouldn't mind, and it sounds like a good thing to have. The _only_
> requirement that I have is that there be no stupid embargo on the list.
> Any list with a time limit (vendor-sec) I will not have anything to do
> with.
> 
> If that means that you can get only the list by invitation-only, that's
> fine. 

So you would be for a closed list, but there would be no incentive at
all for anyone on the list to keep the contents of what was posted to
the list closed at any time?  That goes against the above stated goal of
complying with RFPolicy.

I understand your dislike of having to wait once you know of a security
issue before making the fix public, but how should distros coordinate
fixes in any other way?

thanks,

greg k-h