Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow)

[Greg KH <greg () kroah com>]

On Sun, Mar 03, 2013 at 10:39:30PM -0500, Michael Gilbert wrote:
> I was getting encouraged by the recent anger-centric posts, the "what
> is it that we're supposed to do better?" ones. That gave me some
> encouragement that there was the possibility of positive change, but
> the "we're not going to make users more unsafe by telling them about
> issues affecting them" is a persistence of the denial state.  That
> logic completely violates the known idiom that knowledge is power:
> give users the knowledge that they need to protect themselves, and
> they will; starve them of that knowledge, and they remain vulnerable.

That's a load of crap.

Seriously, you know it only benefits the "bad guys" if I were to say,
"This patch just went into Linus's tree that fixes a security problem
that you can exploit in this manner".  No user would have a chance to
fix their systems before the vulnerability was added to the
"ultra-sploit" tool and everyone would have their systems trashed.

If you so strongly believe this, why is there a linux-distros list in
the first place?

Come on, be realistic people.

greg k-h