Date: Thu, 10 Aug 2000 20:38:25 -0700 (PDT) From: Kris Kennaway <kris@FreeBSD.org> To: Warner Losh <imp@village.org> Cc: "Vladimir Mencl, MK, susSED" <mencl@nenya.ms.mff.cuni.cz>, freebsd-security@FreeBSD.ORG Subject: Re: suidperl exploit Message-ID: <Pine.BSF.4.21.0008102034410.95874-100000@freefall.freebsd.org> In-Reply-To: <200008110330.VAA31484@harmony.village.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, 10 Aug 2000, Warner Losh wrote:
> So no advisory is needed. This is a case where we need a
> non-vulnerabilty alert :-). Of course, such an alert is likely to
> cause more problems than it would solve....
Non-vulnerability alerts like some of the Linux vendors have started
issuing are stupid. If there's no problem, there's no problem, and as long
as you provide a reliable service when there *are* problems, there's no
need to publicize the negative result. The few people who have heard about
it through other channels and want specific reassurance can easily be
accomodated individually through other means (e.g. this list) with much
less effort and without the confusion from people who misinterpet the
contents of the "advisory" as meaning they have to take some action.
Kris
--
In God we Trust -- all others must submit an X.509 certificate.
-- Charles Forsythe <forsythe@alum.mit.edu>
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.21.0008102034410.95874-100000>