oss-sec mailing list archives
Re: Who named shellshock?
From: Solar Designer <solar () openwall com>
Date: Tue, 7 Oct 2014 06:28:28 +0400
Florian, On Mon, Oct 06, 2014 at 02:04:42PM -0700, Michal Zalewski wrote:
I don't think it happened on Twitter - using advanced search with date ranges, I don't see any mentions that would predate this article, which already seems to be using the term: http://www.csoonline.com/article/2687265/application-security/remote-exploit-in-bash-cve-2014-6271.html It's odd that an article posted at 8 AM on Sept 24 would have any idea of how the bug is already being called by the security community, especially ahead of any Twitter buzz. But both Stephane and Florian implied that some of the pre-notified parties apparently started leaking details to the press and were getting ready to make a splash the moment it goes public, so maybe that's the explanation.
I don't know who coined the Shellshock name, but I'd like us to know whether there was in fact a leak, and when. (Luckily, I know it couldn't have been from the distros list, because no detail was posted to the distros list, thanks!) I had raised this concern here: http://www.openwall.com/lists/oss-security/2014/09/24/36 It is insufficient that "it was an honest mistake" and that "apologies were made and accepted." I have no intent to place blame, but at least the general public needs to know whether the information got to the press before or after the scheduled coordinated public disclosure date/time ("Wednesday, 2014-09-24 14:00 UTC"). If it's before, then this qualifies as a leak. If it's after, then it does not. The article has "Sep 24, 2014 8:35 AM PT" on it, which is 15:35 UTC. Did the article's author receive the information before or after 14:00, and when exactly? NB: Please do not provide any information on this to me in private. If you're able to address my question, please do so on the list. Thanks, Alexander
Current thread:
- Who named shellshock? David A. Wheeler (Oct 06)
- Re: Who named shellshock? Jen Savage (Oct 06)
- Re: Who named shellshock? Michal Zalewski (Oct 06)
- Re: Who named shellshock? Larry W. Cashdollar (Oct 06)
- Re: Who named shellshock? Ed Prevost (Oct 06)
- Re: Who named shellshock? Larry W. Cashdollar (Oct 06)
- Re: Who named shellshock? Henry, Bobby (Oct 06)
- Re: Who named shellshock? Larry W. Cashdollar (Oct 06)
- Re: Who named shellshock? Solar Designer (Oct 06)
- Re: Who named shellshock? Michal Zalewski (Oct 06)
- Re: Who named shellshock? Michal Zalewski (Oct 06)
- Re: Who named shellshock? Solar Designer (Oct 06)
- Re: Who named shellshock? Ed Prevost (Oct 06)
- Re: Who named shellshock? Florian Weimer (Oct 07)
- Re: Who named shellshock? Solar Designer (Oct 07)