mailing list archives
Re: Linux's unofficial security-through-coverup policy
From: spender () grsecurity net (Brad Spengler)
Date: Thu, 17 Jul 2008 08:51:37 -0400
they have a policy of non-disclosure? Wierd. Last time I checked
I couldnt get the source code for Windows, IOS, OSX Intel from
a repository open to anyone. and yet those companies have
a good disclosure policy?
Unless you're a programmer and security "expert", what good does the
source do you? You know a subset of these same people can bindiff a
MS patch as well and determine the vulnerability on their own without
any source, right? Your argument only applies if every user of Linux
was a programmer and security expert, so is therefore useless in
I dont get your point. You want them
to specifically state how a vulnerability might actually
WORK and even give you some example code to make your life easier?
That's not at all what we're saying. That thing I said to Valdis about
actually reading the links before replying, there's a reason for it. I
know in this day and age of pseudo-intellectualism, you want to think
you can skim through some posts for five minutes so you can feel like an
expert on the subject, but seriously, read what was linked and then you
wouldn't ask such ignorant questions. There's a lot of information in
there that you couldn't possibly know, as I've pasted several messages
and quotes from their private vendor-sec and kernel-sec mailing lists
(which I don't think you're on).
To answer your immediate question, you could have read several of the
If you don't care enough about the subject to actually research it, why
bother with a kneejerk reply?
Description: Digital signature
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
Re: Linux's unofficial security-through-coverup policy Valdis . Kletnieks (Jul 16)
Re: Linux's unofficial security-through-coverup policy A . L . M . Buxey (Jul 17)
- Re: [Dailydave] Linux's unofficial security-through-coverup policy, (continued)
Re: Linux's unofficial security-through-coverup policy Arturo 'Buanzo' Busleiman (Jul 17)
- Re: Linux's unofficial security-through-coverup policy Brad Spengler (Jul 17)