« Breaking the Bank (Vulnerabilities in Numeric Processing
within Financial Applications) | Main | Spring Framework
vulnerabilities »  GRSecurity Author Outlines Lack of Full
Vulnerability Disclosure by Linux Kernel Developers  From the
'If you don't know, now you know, !@#$!' department  The
following email was sent to the full disclosure mailing list
today by Brad Spengler, the author of GRSecurity.  "I doubt many
of you are following the "discussions" (if they can be called
that) that have been going on on LWN for the past couple weeks
regarding security fixes being intentionally covered up by the
Linux kernel developers and -stable maintainers. Here are some
references:   The Linux kernel has a formal policy in
Documentation/SecurityBugs which states under Section 2
Disclosure: "We prefer to fully disclose the bug as soon as
possible."  However, their policy in reality is quite different,
as you can see for yourself in the "discussion" going on now on
LKML:   Some choice quotes from Linus that reflect how