Slashdot Mirror
Reporting Kernel Security Issues
Omniscientist writes "A recent post on KernelTrap details the lkml post by Chris Wright talking about a centralized place to report security issues pertaining to the Linux Kernel and the discussion that was generated by it, including Chris's followup. It would appear that they now have created a security team to privately handle the bugs, who act as the alternative to reporting the flaw to the public immediately."
FREMONT, CA (TECHNEWS) - After a heated debate at Slashdot executive offices, editor Michael Sims was locked out of the building and departed in a tirade of lisping insults, vowing revenge immediately. This morning, industry sources revealed that Sims has joined the infamous trolling organization Gay Nigger Association of America with the intent of trolling Slashdot fulltime.
In a short phone interview with Technews, Sims asserted that he was calm but resolved on his course of action. "The Slashdot editors and I had a disagreement," he explained. "I did it all for the users, but they..." he drew the syllable out painfully, resting on a case full of Little League trophies and certificates of participation from transgendered dating services, "They just couldn't take my truth. They were -- babies, just babies, oh, the horror, the abomination," he said, before being led away by three white-clad male nurses.
According to Harvard Psychology Professor Arnold Rothstahlberg, "trolling" is an internet phenomenon where dissenting users disrupt a site by flooding it with absurd or paradoxical information. "It satisfies the primal id," he said, chewing on a large, bulbous, phallic black cigar. "To justify themselves by forcing their enemies into hysterics. It's a compensatory mechanism much like getting back at the kids who beat you up in high school by installing Linux and using it to pingflood their XP boxes and Macs."
Slashdot editor CmdrTaco was reticent to comment. At an interview conducted in the crap-filled Ann Arbor bungalow he shares with his wife, to whom he proposed over Slashdot, he said, "Well, you know, Slashdot is just a web site. Michael should calm down about this. But if he doesn't, our corporate sponsors will sue him until he's giving $4 blowjobs on Haight Street."
From the GNAA corporate headquarters, a mysterious floating island off the coast of Newfoundland that few reporters have seen and even fewer have returned from with their sexual identities intact, GNAA "Head Programmer" timecop said he was glad to have Sims on hand. "From what I've seen of his postings on Slashdot," said timecop, "he's a total fag. Which is convenient as all our halfops need anal, and I can't handle the drama. That's what's worst about the net: the drama."
Sims has been involved in previous internet firefights, most notably the controversy over the censorware.org website in 2001. While Sims alleges that the site was his creation that was sabotaged by others, his coworkers disagree. Bennett Haselton, security consultant for the "Anarchy Anal" and "Chaos Cumshot" websites, said of Sims, "We set up this website, and left him the password. We have a disagreement, bam, the website goes down and someone raped my two-week-old Labrador puppy with an iPod."
Slashdot Editor CowboyNeal, who was entangled in a whale net after attempting to swim the English channel, spoke fondly of his former coworker. "Michael always brought a certain passion to the work, a passion that was easily ignited and led to many sweaty sessions in the corporate washroom," he said. "I'm not at all surprised he joined an organization of gay niggers. He always like something different and unique in his pasta salads."
Programmer Seth Finkelstein alleges that Sims is "totally unstable" and agreed readily to this interview. "Of course, I'm a disinterested observer," he said. "But anytime I see that closet psychopath and monkey nut-muncher stealing the spotlight from hardworking programmers like myself, I have to speak up, for the benefit of the people, of course," he said. Technews reporters were permitted to leave the premises only after making a PayPal donation to Finkelstein.
Mike Godwin of the EFF, who balances a career as privacy advocate with his hobby of making videos of teen swingers blowing goats, agreed. "I've never met another editor like Michael," he said. "And, since my regimen of retrovirals is already costing me a
To be honest, I'd rather see any security problems in LKML, than keep them private...a private bug may not be fixed, but when there is a lot of public pressure to get a patch out, if it's not done *FAST* by the developers, someone in the community will do it. This is not the case if it is kept private.
On occasion I like to call it Santix, but I don't want to step on anyone's toes, so I just prepend my initials in front of "Linux" (RMS be damned).
The main thing that I try to focus on is security, and being on the LCML security mailing list has greatly improved my ability to find and squash security issues. You wouldn't believe how many security issues Linux has, actually. Luckily, most of the easy things like buffer exploits are already taken care of. The remaining issues are primarily involved in the timing issues of thread and process context switching. Exploiting the system vulnerability when it is grabbing and releasing resources. That kind of thing.
Whether or not the security list is part of the main LCML list is not really a primary concern. I'd rather have those guys working on features and we on the Security side can get those features secure. If we spent all our time thinking about how to make the system secure, we'd still be stuck with an age-old kernel like OpenBSD!
Keep those bug reports coming!
It's a good idea to have a group that handles security bugs into linux kernel, now we need only that the people that claims herself as "serious" only report the bugs to the kernel-security@*. "Imagine all the people living bug free kernel :)"
http://www.michel.eti.br
"It would appear that they now have created a security team to privately handle the bugs, who act as the alternative to reporting the flaw to the public immediately."
Err.. no - what they have done is create a single point of contact for security related bugs instead of the mish mash we have at the moment. That POC will work with the reporter to publish the bug.
I have an idea - because m&d have trouble installing new software, why not sell Linux preinstalled (with all the autodetection, etc.) on a new hard drive? They buy the HD, take it home, unplug the old one and plug in the new one. If they hate it, they can take the Linux drive out and replace it with the original. PLUS, loading costs are minimal because you can clone everything from a preconfigured master system.
Whaddayathink?
"Lawyers are for sucks."
- Doug McKenzie
No doubt my ignorance showing through but I am surprised there isn't a central repository for all kernel bugs, security or otherwise, already. Else, wouldn't there be a lot of "reinventing the wheel" going on?
The NSA: The only part of the US government that actually listens.
Taken from Linspire Pros:
Taken from Linspire Cons:
I've seen quite a few other examples like that. They mention MacOSX's firewall is activated by default in the summary and in the description later on they say it's not. Mandrake has nearly no cons, and is not the winner. They mention it's "Hard to install other software" (notice the copy-paste)... I think they don't know anything about urpmi...
Don't take this "report" to your boss.
Qui ne va pas à la chasse n'a pas de gibier
PHP Queb
Aren't these problems inevitable with any community-developed software, that the people who have input on to project need to be aware of problems on the project?
Unfortunately, trust is an issue: the inclusion of anyone who may be able to help out opens the doors to anyone who wants to attack. Additional complexity arises when the project is sold as a product; because the people using the product actually need to become involved in the community project too if they are to get the best support. Vendor-sec kind of does this for the Kernel, but the Kernel maintainers don't think that this is enough, because it's done reasons that are, broadly, not about making the best code as safe as possible (PR publication, politics are cited in the article, but I'm not involved and haven't seen).
If this one list gets set up, there will be a need also for trusted individuals to be included on any private security list to watch and make sure that bugs are squashed, not to code or argue about how to fix a hole. I understand that this would be anathema to the maintainers who want as few people as possible on such a list to stop leaks, but see it as an important part of the community process.
Most of the comments I've read so far seem to be missing the point. The idea of this security team is to make sure that there aren't any publicly known exploits in the kernel without a patch being available; at the moment this is inevitable if a bug is reported directly to the kernel guys, due to the policy of immediate disclosure.
This move is primarily to stop companies running linux from going to commercial vendors to patch their kernel for them, and thus keeping linux security centralised.
One good turn - gets all the covers.
in soviet russia, kernel reports YOU
its a dirty job, but someone had to do it...
As long as it is ALWAYS mirrored and PUBLIC. I do,nt agree with their idea to make encrypted bug reports preferable, digitally signed maybe but not encrypted. I can totally understand why Linus would be against it.
NO ONE GIVES A SHIT. slashdot is not page 6 for the linux faggots...
Holding security holes private for a limited time does make sense, but the key word is *limited*. That delay is there for the sole purpose of making sure the fix is available when the hole is disclosed. The limited part means that nobody sits on security holes, and if it becomes public without a fix, the community kicks in. Even if a fix is announced along with the hole, it's entirely possible that the community will come up with a better/cleaner fix.
Keeping "limited delay" short is the key.
The living have better things to do than to continue hating the dead.
Ok... when are you going to fix the nearly 2-year old Linux Security Module (LSM)'s security vulnerability for inserting malicious kernel modules (aka virus or trojans)?
So, I'm thinking that these "sky-is-falling" guys that have been ranting, raving and waving red flags over at GRSecurity, RSBAC are starting to have a solid valid point on the inherent weakness of the LSM model.
I truly hope this is not the beginning of open season for Linux-virus/trojans.
Ah? Hmmmmm? Welll?
OS X is built on a foundation of Unix, but is written and maintained by professional American programmers who know security as well as performance and usability. By comparison Linux is written by Linus Torvalds and ... who knows? It could be your neighbor, or it could be some guy in Iran or North Korea. Linux also has significant intellectual property issues, due to the nature of the open source process whereby code can be inserted into the program by people who are unhappy about their job and so steal it from their company or friends. So why take a risk being hacked or even sued using Linux? Switch to OS X.
Isn't this quite similar to MS policy on bugs?
A real live person to send LSM vulnerability reports to.
- every person can try to exploit it on "unpatched" systems long time after
I think you forgot the Linux kernel is open source; if a bug isn't annouced publicly when it is found, it is publicly annouced by the patch that is produced to fix it.
I'd rather see the bug annouced publicly and fixed immediately than kept private, fixed eventually, and continue still be an issue on unpatched systems.
the rest of the population might not even know the bug exists until a patch is released (moreso, you might not even know what the bug was)
And you seriously think system administrators are taking the time to actually patch systems against a bug they know nothing about?
Because when a patch gets released and there will be an advisory coming with it, malicious cr4x0rz *will* know where the bug is and how to exploit it. So, your plan leaves no choice but to stop releasing kernel advisories.
In need of reliable and affordable server monitoring?
I use OpenBSD, it's made by canadians who don't pay US taxes (ie, fund the "war" with Iraq).
Don't use OS/X unless you want to fund Fuhrer Bush's war machine!
Delegated and distributed != "mish mash".
... have created a security team to privately handle the bugs...
It means they have created a team that can change anything unseenly.
I do,nt agree
"don't".