Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: [Full-disclosure] [Dailydave] Linux's unofficial security-through-coverup policy
From: "Elazar Broad" <elazar () hushmail com>
Date: Thu, 17 Jul 2008 10:35:21 -0400

I could understand why Linus is against classifying a commit 
comment in his branch or in a any unstable branch for that 
matter...then again, the repositories are open, and anyone with 
half a brain might be able to discern what has security 
ramifications or not. On the other hand classifying commit comments 
in stable branch(es) is a must, and the lack of CVE identifiers is 
very troublesome. 

Well, if they aren't going to do it, its up to the community to 
point it out, get the issues tracked in SecurityFocus and the like 
so that people know that its out there and the distros along with 
the general public don't have to rely on "HIGHLY SUGGESTED THAT YOU 
UPGRADE" announcements from the kernel maintainers without knowing 
why.

Elazar

On Thu, 17 Jul 2008 06:57:57 -0400 Dave Aitel 
<dave () immunityinc com> wrote:
I think what Brad and the Pax Team are saying here is that:
1. We hold Linux to a higher standard than a company - we expect 
the 
term "open source" to apply to more than just the source code.
2. For that reason, the community finds it discomforting when 
kernel 
maintainers know that a patch has a serious security ramification 
and 
essentially lie about it by neglecting to put that into the patch 
comments. That's the sort of behavior we expect from a large 
commercial 
entity.
3. This only hurts end users, because the hackers already know 
about it.

If the kernel maintainers had read the Microsoft team's SDL book, 
they'd 
probably be more up to speed on these things. :>

-dave



Brad Spengler wrote:
| Valdis,
|
| Please try to stay consistent with your own arguments.  If you 
defeat
| them yourself barely into your third paragraph, you don't give 
me much
| to do!
|
| To summarize:
|
|> have any untrusted local users - for instance, my laptop.  The 
only users
|> on it are me, myself, and I<, and the guy that owned my 
webserver, or
| the guy that owned my email client, or the guy that owned my 
audio
| player, or the guy that owned my video player, or the guy that 
owned my
| web browser, or the guy that owned my FTP client, or the guy 
that owned
| my PDF reader, or the guy that owned my office application>
|
| You're a very trusting individual!
|
| This is exactly why telling someone to update if they have any
| "untrusted local users" just doesn't make any sense since it 
misleads a
| majority of users.  A better replacement would be "if your 
machine is
| network-connected."  How do you own a website if you can't break 
into it
| directly?  Find out what other websites are hosted on the same 
machine,
| break into one of them, then locally escalate privileges, giving 
you
| access to all the websites hosted on the machine.  If you don't 
think
| this happens, you've got your head in the sand and honestly 
should just
| give up having anything to do with security.
|
| -Brad
|
| -------------------------
|
| _______________________________________________
| Dailydave mailing list
| Dailydave () lists immunitysec com
| http://lists.immunitysec.com/mailman/listinfo/dailydave

--
Click for quotes on adjustable mortgages.
http://tagline.hushmail.com/fc/Ioyw6h4dOB3vJ6t2RHYfNNcMAdZxCoaJvTLB636Im56JbXVJrQ7UIQ/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]