A bunch of things need to be said here.

First of all, this article fails to note a couple things about Spengler's original advisory. It does not mention that Spengler's idea of "vendor notification" was to send an e-mail direct to Linus Torvalds, rather than to the LKML or the relevant maintainer of that section of the kernel (and as a different poster mentioned, it doesn't take much effort to track down who maintains a particular area of the kernel). How many e-mails a day does Linus get, I wonder? It also does not mention that the advisory doubled as an advertisement/release announcement for Spengeler's new security product - as such, one could surmise that Spengler had more of a need for publicity and less of a need to actually report a vulnerability through the existing channels.

Second comment is that this article has a terribly misleading title. The real focus of the article is the lack of a central Linux kernel security contact, so how exactly does this end up getting translated to "Linux Kernel Security is Lacking?"

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/296/30335#30335