Re: Linux's unofficial security-through-coverup policy

[spender () grsecurity net (Brad Spengler)]

> they have a policy of non-disclosure?  Wierd. Last time I checked
> I couldnt get the source code for Windows, IOS, OSX Intel from
> a repository open to anyone.  and yet those companies have
> a good disclosure policy?

Unless you're a programmer and security "expert", what good does the 
source do you?  You know a subset of these same people can bindiff a 
MS patch as well and determine the vulnerability on their own without 
any source, right?  Your argument only applies if every user of Linux 
was a programmer and security expert, so is therefore useless in 
reality.

> I dont get your point. You want them
> to specifically state how a vulnerability might actually
> WORK and even give you some example code to make your life easier?

That's not at all what we're saying.  That thing I said to Valdis about 
actually reading the links before replying, there's a reason for it.  I 
know in this day and age of pseudo-intellectualism, you want to think 
you can skim through some posts for five minutes so you can feel like an 
expert on the subject, but seriously, read what was linked and then you 
wouldn't ask such ignorant questions.  There's a lot of information in 
there that you couldn't possibly know, as I've pasted several messages 
and quotes from their private vendor-sec and kernel-sec mailing lists 
(which I don't think you're on).

To answer your immediate question, you could have read several of the 
postings, including:
http://marc.info/?l=linux-kernel&m=121616990509661&w=2

If you don't care enough about the subject to actually research it, why 
bother with a kneejerk reply?

-Brad

Attachment: signature.asc
Description: Digital signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/