Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Russ Allbery <eagle () eyrie org>]

Marc Deslauriers <marc.deslauriers () canonical com> writes:

> I would argue against having a policy requiring something like this to
> be made public immediately. The important thing here is to do whatever
> it takes to make sure users are secure as fast as possible, not expose
> them to even bigger attack surface with no mitigation available.

There is an interesting potential disagreement of interests here, too, in
that one's ability to respond to a disclosed vulnerability with no
available updated packages is heavily resource-dependent.  Large
(security-savvy) companies may reasonably prefer disclosure as early as
possible because they have in-house security teams that follow lists like
this and are capable of taking immediate action in advance of a general
fix.  However, smaller organizations or individuals who are reliant on
distributions for notification and patches are potentially more vulnerable
to any increased attacker activity that might happen due to the public
announcement and before the availability of updated packages.

That gap could be closed somewhat by distributions sending immediate
security alerts with mitigations and workarounds once the issue becomes
public and then following up with alerts once patches are available, at
the cost of an obvious increase in work and stress for distributions (and
possible contention of resources between putting out a migitation alert
and preparing a proper fix).

(Disclosure: I am a member of the Debian project, but I am not a member of
the Debian security team and am speaking solely for myself here.)

-- 
Russ Allbery (eagle () eyrie org)             <https://www.eyrie.org/~eagle/>