zmanion

@tknarr@mstdn.social @wolf480pl@mstdn.io @pgl@infosec.exchange @jayjacobs@infosec.exchange A somewhat open question: Are there just "conditions" and attackers have one perspective, environment/defenders have a different perspective? Or are there conditions that are specific to attacker vs. environment?

@adamshostack@infosec.exchange @pgl@infosec.exchange @jayjacobs@infosec.exchange I'm initially a fan of the explicit/implicit security policy violation, I think we'd need both: Someone could explicitly declare that they allow remote, unauthenticated access or control of a system, but everyone else may treat that as an implicit violation.

@aristot73@infosec.exchange @bagder@mastodon.social @icing@chaos.social Given the history of some of the people and organizations, I'm confident at least Akrites and Lightwell will engage thoughtfully with upstream (the others maybe too, I'm not familiar with them). I'm more concerned with the technical processes at scale. We automate discovery, what about verification, reporting/notification, tracking comms and embargoes (if there are any at all), testing, reviewing, documentation (CVE, etc).

@gregkh@social.kernel.org @joshbressers@infosec.exchange @wdormann@infosec.exchange @Viss@mastodon.social Because it exists and works better than the alternatives: telling nobody (and waiting to see who notices and when) or telling everybody all at once. If you have regulatory requirements to do or not do something, by all means, follow the regs. I'm not claiming any regs implement sound public CVD policy. Also when there is an external finder, the finder could choose to notify distros or follow other coordination paths, in addition to notifying kernel.org. (I also understand that it's not quite as simple as just dropping a message on the distros list, and I read a Qualys message explaining that they no longer use distros.)

@gregkh @joshbressers @wdormann @Viss so there's absolutely no middle ground? When there is clearly a bug with security impact, give the distros list a week notice (two weeks max, per their policy). If it leaks, outcome is no worse than not notifying distros. The researcher can even do it instead of the kernel. At scale (Linux!) this seems like a Pareto distribution: major distros cover disproportionally most users.