> they have a policy of non-disclosure? Wierd. Last time I checked > I couldnt get the source code for Windows, IOS, OSX Intel from > a repository open to anyone. and yet those companies have > a good disclosure policy? Unless you're a programmer and security "expert", what good does the source do you? You know a subset of these same people can bindiff a MS patch as well and determine the vulnerability on their own without any source, right? Your argument only applies if every user of Linux was a programmer and security expert, so is therefore useless in reality. > I dont get your point. You want them > to specifically state how a vulnerability might actually > WORK and even give you some example code to make your life easier? That's not at all what we're saying. That thing I said to Valdis about actually reading the links before replying, there's a reason for it. I know in this day and age of pseudo-intellectualism, you want to think you can skim through some posts for five minutes so you can feel like an expert on the subject, but seriously, read what was linked and then you wouldn't ask such ignorant questions. There's a lot of information in there that you couldn't possibly know, as I've pasted several messages and quotes from their private vendor-sec and kernel-sec mailing lists (which I don't think you're on). To answer your immediate question, you could have read several of the postings, including: http://marc.info/?l=linux-kernel&m=121616990509661&w=2 If you don't care enough about the subject to actually research it, why bother with a kneejerk reply? -Brad
Attachment:
signature.asc
Description: Digital signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/