oss-sec mailing list archives
Re: linux-distros membership application of openEuler
From: Greg KH <greg () kroah com>
Date: Thu, 28 Dec 2023 10:31:42 +0000
On Tue, Dec 26, 2023 at 01:35:55AM +0100, Solar Designer wrote:
On Tue, Dec 26, 2023 at 12:38:36AM +0100, Steffen Nurpmeso wrote:and i really today stumbled over his funny opinion . All "early notice" lists are leaks and should be considered public. . Unless your project is not used by anyone. . Otherwise, why would your government allow it to exist?I think Greg's stance on this is inconsistent, if we also recall his preference against full public disclosure of issues discussed on private lists and his running of private lists on CPU microarchitectural issues.
As you are referring to my talk here, I figured I would point out that later on in it I do talk explicitly about the private lists that we run for these CPU issues and how much we hate them. Companies who are currently not on these lists are actively trying to circumvent them to get access to the information on them, despite all of the lawyers and governments involved agreeing that this is the best and only way we know how to handle these types of issues at the moment. In other words, I hate them, companies hate them, and governments hate them, but no one involved has solid ideas of what to do instead. "Luckily" I think that laws like the CRA are going to make them obsolete in a few years time so maybe that will cause them to go away as I don't see any end of CPU bugs happening before then.
However, the concern about leaks is valid. I think the most effective defense we have is the 14 days maximum embargo time, which removes the data's long-term value for potential use in attacks.
Again, I still consider this a form of blackmail against open source projects when you do this, but hey, you do you :) thanks, greg k-h
Current thread:
- Re: linux-distros membership application of openEuler, (continued)
- Re: linux-distros membership application of openEuler Aron Xu (Oct 16)
- Re: linux-distros membership application of openEuler Demi Marie Obenour (Oct 16)
- Re: linux-distros membership application of openEuler Tianyu Chen (Oct 16)
- Re: linux-distros membership application of openEuler Igor Seletskiy (Oct 16)
- Re: linux-distros membership application of openEuler Solar Designer (Dec 23)
- Re: linux-distros membership application of openEuler Igor Seletskiy (Dec 23)
- Re: linux-distros membership application of openEuler Alexander E. Patrakov (Dec 24)
- Re: linux-distros membership application of openEuler Solar Designer (Dec 25)
- Re: linux-distros membership application of openEuler Steffen Nurpmeso (Dec 25)
- Re: linux-distros membership application of openEuler Solar Designer (Dec 25)
- Re: linux-distros membership application of openEuler Greg KH (Dec 28)
- Re: linux-distros membership application of openEuler Demi Marie Obenour (Dec 28)
- Re: linux-distros membership application of openEuler Greg KH (Oct 16)
- Re: linux-distros membership application of openEuler Steffen Nurpmeso (Oct 16)
- Re: linux-distros membership application of openEuler W. Wadepohl (Oct 17)