Re: [stable] Linux 2.6.25.10

Tiago Assumpcao
2008-07-16T01:12:54Z

Linus Torvalds wrote:
>
> Umm. And if the whole discussion it was hidden from us on some private
> vendor list, why should we then help track their hidden state?
>
> That's what you claimed we should do, wasn't it?

How can I expect one to treat the unknown? If you are not aware of it,
you do nothing. Whenever a software organization is informed of a
problem in some product of their responsibility, they act upon it. On
the contrary, no, I don't expect any magic from you. Thanks for
bothering, though.

>
>> Personally, I, too, have a major disgust for most crap seen in the so called
>> info-sec world. I hand you my agreement on this one.
>> Except, it changes in nothing your responsibilities.
>
> My responsibility is to do a good job. And not pander to the people who
> want to turn security into a media circus.

And I thank you for that. No to the "security media circus".

>
> Which is exactly what I'm doing. No media circus.
>
> Linus
>

Wrong. This is not "media circus".
Whoever reads this thread with the basic understanding of software
development procedures, the reality of information security and with
legit judgment will clearly understand what you are doing and what
"pageexec" and I claim for. Further, I claim for decency from your part.

All I ask for is to receive the "There are updates available." message
as soon as one security problem is reported, understood and treated by
your development part. And that is, the sooner possible, if you please.
Plus, if one bothers, to be able to know the exact location of this bug
and its characteristics.

However, for these to happen, we need your collaboration. Or, with two
words, your responsibility.

Thanks,
--t