[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHmME9qGH4xSP1EfqY3J-Kp=yi5Rojw3X9nXMqnmXd5Lfe-czQ@mail.gmail.com>
Date: Thu, 28 Feb 2013 00:27:09 +0100
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: Daniel Kahn Gillmor <dkg@...thhorseman.net>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE request - Linux kernel: VFAT slab-based buffer overflow
On Thu, Feb 28, 2013 at 12:17 AM, Daniel Kahn Gillmor
<dkg@...thhorseman.net> wrote:
> Even if this were true, it takes much more than a single cycle to write
> up a decent security report that can be understood by other people.
> Communication takes time and effort. Good communication takes even more
> time and effort.
I agree with this. I was referring to Greg's first mentioned stage of
classifying the bug, which for some cases is easy, though, as I said,
not in all cases. What you refer to is Greg's mentioned second stage,
of notification. This often can indeed be time consuming, as you
mentioned.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
