Re: cloud computing provider disclosures
Researchers say cloud providers often miss advance notices and want a clearer Linux disclosure path.
On the oss-security list, Jan Schaumann replied to a discussion of vulnerability disclosures to cloud computing providers. The thread says providers may not consistently receive advance notifications, and that centralizing the process could help researchers disclose responsibly. Participants also call the current Linux kernel disclosure path suboptimal for urgent issues.
- Cloud providers do not consistently receive advance vulnerability notifications.
- A centralized process could help researchers disclose issues responsibly.
- The Linux kernel disclosure path is described as suboptimal for urgent bugs.
Posted by Jan Schaumann on Oct 05 Demi Marie Obenour wrote: I think this somewhat helps make my point: cloud compute providers may use several of those, but not consistently (or at all) receive advanced notifications. Centralizing this (with, agreed, some definitions of who qualifies to be determined) would also make it easier for researchers to responsibly disclose. The linux kernel disclosure path is currently rather suboptimal, with urgent...
This source does not provide full text. Read it at seclists.org.