From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756795AbYGPAk4 (ORCPT ); Tue, 15 Jul 2008 20:40:56 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753974AbYGPAkq (ORCPT ); Tue, 15 Jul 2008 20:40:46 -0400 Received: from ax54.genwebserver.com ([72.18.156.50]:55546 "EHLO ax54.genwebserver.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753912AbYGPAkq (ORCPT ); Tue, 15 Jul 2008 20:40:46 -0400 Message-ID: <487D4301.5080609@assumpcao.org> Date: Tue, 15 Jul 2008 21:38:25 -0300 From: Tiago Assumpcao User-Agent: Thunderbird 2.0.0.14 (Windows/20080421) MIME-Version: 1.0 To: Linus Torvalds CC: pageexec@freemail.hu, Greg KH , Andrew Morton , linux-kernel@vger.kernel.org, stable@kernel.org Subject: Re: [stable] Linux 2.6.25.10 References: <20080703185727.GA12617@suse.de>, <487D3056.1183.1C0E1C47@pageexec.freemail.hu>, <487D3C17.31467.1C3C0441@pageexec.freemail.hu> In-Reply-To: X-Enigmail-Version: 0.95.6 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - ax54.genwebserver.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - assumpcao.org X-Source: X-Source-Args: X-Source-Dir: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Linus Torvalds wrote: > > On Tue, 15 Jul 2008, Tiago Assumpcao wrote: >> However, as I previously explained [http://lkml.org/lkml/2008/7/15/654], >> security issues are identified and communicated through what can be a long and >> complicated (due to DNAs, etc.) process. If it culminates at implementation, >> without proper information forwarding from the development team, it will never >> reach the "upper layers" -- vendors, distributors, end users, et al. > > Umm. That shouldn't be our worry. Yeah, at this point, it is clear to the world. No needs for repeated wording ;) > If others had a long and involved (and broken) process, they should be the ones that track the fixes too. We > weren't involved, we didn't see that, we simply _cannot_ care. You weren't involved? Hold on, aren't you the developers, thence, those who commit mistakes, a.k.a the bug inducing point? > >> Therefore, yes, it is of major importance that you people, too, buy the >> problem and support the process as a whole. Otherwise... well, otherwise, >> we're back to where we started, 20 years ago. Good luck Linux users. > > Umm. What was wrong with 20 years ago exactly? What was wrong for the computer theoretic people about 100 years ago? Lack of development? Not sure. Perhaps the same that existed for information security 20 years ago. Just perhaps. I apologize for assuming you hold such information, anyway. > > Are you talking about all the wonderful work that the DNS people did for > that new bug, and how they are heroes for synchronizing a fix and keeping > it all under wraps? > > And isn't that the same bug that djb talked about and fixed in djbdns from > the start? Which he did about ten YEARS ago? Are you trying to justify your irresponsibly indulgent act towards the operating system that my mother is likely to use with one alone exception? Because it rains umbrellas are a waste of time? > > Excuse me for not exactly being a huge fan of "security lists" and best > practices. They seem to be _entirely_ be based on PR and how much you can > talk up a specific bug. No thank you, > > Linus Personally, I, too, have a major disgust for most crap seen in the so called info-sec world. I hand you my agreement on this one. Except, it changes in nothing your responsibilities. Take good care, --t