Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 492
Alerts This Week
Warning Icon 1 492

Exploring Linux Process Security and Public Vulnerability Disclosure

Calendar May 19, 2005 • User Avatar Anthony Pell
1 min read
General Esm H446
Topics%20covered

Topics Covered

kernel security security flaws process security public disclosure vulnerability management open source model
In his latest entry, Dana asks whether the Linux process is insecure, because it’s not possible to warn the "vendor" before warning the general public about security flaws in Linux. He also notes that "Microsoft has theoretical control of this situation." There are several problems with this line of reasoning. I’m not going to argue that the open source model of development is perfect, but it offers several advantages over the proprietary model. Let’s start with the most obvious.

Yes, if I discover a vulnerability in the Linux kernel — or any other open source project that does development on public lists and completely out in the open — when I reveal the problem on the development mailing list, I reveal it to the public. It’s worth noting that some open source projects, like Mozilla Foundation, have systems that allow developers to file bugs and security issues without disclosing details to the public at large.

The link for this article located at ZDNet is no longer available.