Re: [Ksummit-discuss] [CORE TOPIC] dev/maintainer workflow security

[Kees Cook <keescook@chromium.org>]

On Sat, Jul 11, 2015 at 9:38 AM, Theodore Ts'o <tytso@mit.edu> wrote:
> On Sat, Jul 11, 2015 at 04:02:02PM +0000, Jason Cooper wrote:
>>
>> Could we have some sort of post-vuln/CVE conversation dissecting the
>> vulnerability and how it got there?  Or, perhaps select a few for
>> process-dissection to be presented at the summit?
>
> Kees did a really good presentation entitled "security anti-patterns"
> a year or two ago at a kernel summit (the one at Edinburgh if I
> remember correctly?).  Kees, do you think it would be worth updating
> and re-doing that presentation?  And perhaps at a wider set of venues
> beyond just the kernel summit....

I can, yeah, but I sort of think stuff like that is really just
"reference material", and sometimes too specific. Reviewers (and
authors) need to think about high-level risks, not just mechanical
flaws. I would agree that beefing up reviewer roles could really help
this part of the problem, though.

-Kees

-- 
Kees Cook
Chrome OS Security