OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: SysVinit audit: mesg and wall
From: Solar Designer (solarfalse.com)
Date: Mon Sep 04 2000 - 04:37:46 CDT

> > > Looks good. What exactly is Owl?
> >
> > The distribution we (a small team) are developing. It's not ready
> > for the public yet.
>
> And holding security patches from the public at large is good for...?

1. Making sure a security patch is properly handled by at least some
distribution vendors is time-consuming, but I still have the hope to
have the time for that after our set of required packages is ready.
For example, the recent glibc bugs took more of my time to report to
distribution vendors and double-check the updated packages (at least
one distribution got it wrong at first) than it did to find the bugs(*).
If I were to handle every bug in such a way, we wouldn't complete the
set of packages in a reasonable time. However, this doesn't mean we
shouldn't try to contact package maintainers and let them have a look
at the patches before or at the same time the patches are made public.

(*) OK, I've missed one that is now known, thanks to Jouko Pynnönen.

2. Some patches I've already made public, including on this list (if
I post an URL that has /pvt/ in it to a public list, I effectively
make the patch public, don't I?), -- such as, in cases where this would
avoid duplicate work by others. For these patches, I tried to get
the message to package maintainers at the same time.

3. I'd like to ensure proper credit when releasing the entire set of
patches, and there're still some issues to resolve.

Signed,
Solar Designer