Re: thoughts on kernel security issues

[Marcelo Tosatti <marcelo.tosatti@cyclades.com>]

On Thu, Jan 13, 2005 at 03:36:27PM +0000, Alan Cox wrote:
> On Mer, 2005-01-12 at 17:42, Marcelo Tosatti wrote:
> > The kernel security list must be higher in hierarchy than vendorsec.
> > 
> > Any information sent to vendorsec must be sent immediately for the kernel
> > security list and discussed there.
> 
> We cannot do this without the reporters permission. Often we get
> material that even the list isn't allowed to directly see only by
> contacting the relevant bodies directly as well. The list then just
> serves as a "foo should have told you about issue X" notification.

Well the reporters, and vendorsec, have to be aware that the 
"kernel security list" is the main discussion point of kernel security issues.

If the embargo period is reasonable for vendors to prepare their updates and 
do necessary QA, there should be no need for kernel issues to be coordinated 
(and embargoed) on vendorsec anymore. Does it make sense?
Of course vendorsec gets informed of what is happening at "kernel security list".

The main reason for reporters to require "permission" to spread the information
is because they want make a PR of their discovery, yes?

In that case they should be aware that submitting to vendorsec means submitting
to kernel security, and that means X days of embargo period.

> If you are setting up the list also make sure its entirely encrypted
> after the previous sniffing incident.

Definately, I asked Chris about it...