Torvalds on the Linux Security Process

darthcamaro writes "Linus Torvalds thinks that Linux kernel security disclsoure should be completely open and he really doesn't like the vendor-security model of having a time embargo on security disclosure. 'I think kernel bugs should be fixed as soon as humanly possible, and any delay is basically just about making excuses,' Torvalds wrote. 'And that means that as many people as possible should know about the problem as early as possible, because any closed list (or even just anybody sending a message to me personally) just increases the risk of the thing getting lost and delayed for the wrong reasons.'"

Comments

Mailing list thread

[OblongPlatypus]

Since the article is pretty much a copy/paste job from the lkml, why not link directly to the thread in question?

Re:You should listen to him...

[MBAFK]

The systems would still be vulnerable with no patch available. The administrators might not know there was a vulnerability but an attacker may know about it.

Keeping it a secret might put you at a greater risk - you don't know you might be in trouble but the bad people know about the problem.

So reducing the number of people who know about the problem could make it worse rather than better.

Re:You should listen to him...

[A beautiful mind]

IF someone would have linked to the full discussion, it would have turned out that he suggested a 5 working day embargo on the disclosure MAX. They say and i think i have to agree, that it's enough time for vendors to catch up. Anything more just makes the problem worse. They will disclose everything after that embargo of course. There are a lot of good ideas and views and Linus refined his opinion more than once so it would be good to read the original discussion and not react based on the submitter's pick.

Just to note, im reading LKML for over a year now and i read most of the mail about this thread aswell.