Re: [Ksummit-discuss] [TECH TOPIC] Security

[Jiri Kosina <jikos@kernel.org>]

On Sat, 22 Sep 2018, Dan Carpenter wrote:

> Sort of related to this.  I think we should have a public email list to
> discuss potential security problems.  We've actually talked about making
> the security@kernel.org list public at some point when people started
> flooding it with static checker warnings about potential SELinux missing
> checks.
> 
> The downsides are 1) Maintainers will be annoyed.  They don't want me or
> anyone to forward them static checker output (they are polite about
> this).  But they also want to be the first to know about real bugs found
> by static analysis.  These are conflicting and impossible desires...  2)
> Script kiddies will follow the list and learn about bugs earlier.  I
> don't see this as a huge issue if we restricted it to driver specific
> bugs.

3) there simply is a need for CRD process for the kernel (which pretty 
   much by definition is not happening publicly). Currently, security@ 
   serves that purpose, so if you make that public, you have to 
   instantiate some other process to deal with CRDs.

-- 
Jiri Kosina
SUSE Labs