?It does not mention that Spengler's idea of "vendor notification" was to send an e-mail direct to Linus Torvalds, rather than to the LKML or the relevant maintainer of that section of the kernel (and as a different poster mentioned, it doesn't take much effort to track down who maintains a particular area of the kernel).?

Firstly, I don't think that the LKML is an appropriate forum to discuss security vulnerabilities.

Secondly, as per my previous response, the MAINTAINERS file is hardly exhaustive. Additionally, I do not think that each individual contributor / maintainer should be responsible for handling official correspondence with security researchers, and all the other responsibilities that would otherwise be handled by a dedicated security team.

?How many e-mails a day does Linus get, I wonder??

Probably a lot. However, three *weeks* without so much as a response? This clearly illustrates a problem with the way things are currently handled.

?one could surmise that Spengler had more of a need for publicity and less of a need to actually report a vulnerability through the existing channels.?

I think his comments, although harsh, were warranted. Looking through some Linux kernel-related mailing lists, at least things are being done about these problems now. If there wasn't a problem in the first place, then these discussions wouldn't be going on.

?Second comment is that this article has a terribly misleading title. The real focus of the article is the lack of a central Linux kernel security contact, so how exactly does this end up getting translated to "Linux Kernel Security is Lacking?"?

I only have so much space in one of these articles to talk about the issues at hand, and perhaps I didn't put as much focus on code quality / the general approach to security as I would have liked. Perhaps I'll leave that for another article, however, regardless of weather or not all of my concerns were discussed well enough in the article, I do personally believe that the Linux kernel development team needs to do something about the way they treat security.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/296/30363#30363