Re: [stable] Linux 2.6.25.10

[Tiago Assumpcao <tiago@assumpcao.org>]

Linus Torvalds wrote:
> 
> Umm. And if the whole discussion it was hidden from us on some private 
> vendor list, why should we then help track their hidden state?
> 
> That's what you claimed we should do, wasn't it?

How can I expect one to treat the unknown? If you are not aware of it, 
you do nothing. Whenever a software organization is informed of a 
problem in some product of their responsibility, they act upon it. On 
the contrary, no, I don't expect any magic from you. Thanks for 
bothering, though.

> 
>> Personally, I, too, have a major disgust for most crap seen in the so called
>> info-sec world. I hand you my agreement on this one.
>> Except, it changes in nothing your responsibilities.
> 
> My responsibility is to do a good job. And not pander to the people who 
> want to turn security into a media circus.

And I thank you for that. No to the "security media circus".

> 
> Which is exactly what I'm doing. No media circus.
> 
> 		Linus
> 

Wrong. This is not "media circus".
Whoever reads this thread with the basic understanding of software 
development procedures, the reality of information security and with 
legit judgment will clearly understand what you are doing and what 
"pageexec" and I claim for. Further, I claim for decency from your part.

All I ask for is to receive the "There are updates available." message 
as soon as one security problem is reported, understood and treated by 
your development part. And that is, the sooner possible, if you please.
Plus, if one bothers, to be able to know the exact location of this bug 
and its characteristics.

However, for these to happen, we need your collaboration. Or, with two 
words, your responsibility.


Thanks,
--t