| 1 |
Im interested, no C knowledge but plenty of time, passed the dev exam |
| 2 |
and a willingness to learn. It's been on my agenda for a long time. |
| 3 |
|
| 4 |
nick loeve wrote: |
| 5 |
> I can help also... i have limited free time but am willing to put in |
| 6 |
> some hours... |
| 7 |
> |
| 8 |
> I have medium C knowledge, reasonable kernel experience, and also a |
| 9 |
> strong linux background |
| 10 |
> |
| 11 |
> On Thu, Feb 21, 2008 at 8:02 AM, Arthur Bispo de Castro |
| 12 |
> <arthur@××××××××××××××.br> wrote: |
| 13 |
>> I'm interested... little C knowledge, very curious about kernel, strong |
| 14 |
>> linux background... |
| 15 |
>> |
| 16 |
>> is there another prereq to join this? |
| 17 |
>> |
| 18 |
>> |
| 19 |
>> |
| 20 |
>> On Thu, Feb 21, 2008 at 04:20:02AM -0200, Juan Pablo Olivera wrote: |
| 21 |
>> > I am interested too :) |
| 22 |
>> > |
| 23 |
>> > No C knowledge but strong linux background and very organized guy. |
| 24 |
>> > |
| 25 |
>> > On Thu, 2008-02-21 at 01:05 -0500, Casey Link wrote: |
| 26 |
>> > > It would probably help if we knew how many people were interested. |
| 27 |
>> > > |
| 28 |
>> > > I am. +1 |
| 29 |
>> > > |
| 30 |
>> > > Casey |
| 31 |
>> > > |
| 32 |
>> > > On Wed, Feb 20, 2008 at 10:16 PM, Eduardo Tongson <propolice@×××××.com> wrote: |
| 33 |
>> > > > Alright how do we proceed to get this team started. |
| 34 |
>> > > > |
| 35 |
>> > > > ed*eonsec |
| 36 |
>> > > > |
| 37 |
>> > > > |
| 38 |
>> > > > |
| 39 |
>> > > > On Thu, Feb 21, 2008 at 6:55 AM, Ned Ludd <solar@g.o> wrote: |
| 40 |
>> > > > > |
| 41 |
>> > > > > |
| 42 |
>> > > > > On Wed, 2008-02-20 at 13:59 -0500, Harlan Lieberman-Berg wrote: |
| 43 |
>> > > > > > On Sunday 17 February 2008 23:12:35 Robert Buchholz wrote: |
| 44 |
>> > > > > > > On Sunday, 17. February 2008, Eduardo Tongson wrote: |
| 45 |
>> > > > > > > > What specific kernel knowledge is needed to get a Kernel advisory up |
| 46 |
>> > > > > > > > and running ? |
| 47 |
>> > > > > > > |
| 48 |
>> > > > > > > Between becoming aware of a vulnerability in Linux and drafting an advisory |
| 49 |
>> > > > > > > for one or all kernel sources comes the part where you review which |
| 50 |
>> > > > > > > versions of which kernel sources are affected and unaffected. You also |
| 51 |
>> > > > > > > need to pay attention to specifics of the added patchsets, which might |
| 52 |
>> > > > > > > duplicate vulnerabilities. |
| 53 |
>> > > > > > > |
| 54 |
>> > > > > > > Parts of the job can indeed be done without Kernel and C knowledge, but |
| 55 |
>> > > > > > > some cannot. So if we draft a new kernel security *team*, people without C |
| 56 |
>> > > > > > > and kernel knowledge are helpful -- some others need to have it, though. |
| 57 |
>> > > > > > > |
| 58 |
>> > > > > > > Robert |
| 59 |
>> > > > > > |
| 60 |
>> > > > > > To be honest, 99% of what is done in the kernel security team can be done with |
| 61 |
>> > > > > > no C knowledge at all. |
| 62 |
>> > > > > > |
| 63 |
>> > > > > > I'm not an expert C person - far from it - but I eventually became the head of |
| 64 |
>> > > > > > Kernel Security until I retired a few months ago. |
| 65 |
>> > > > > > |
| 66 |
>> > > > > > Most of it is bug handling. The major problem is a social, not a technical |
| 67 |
>> > > > > > one. Because of the manner in which our kernels are organized, a single |
| 68 |
>> > > > > > vulnerability involves checking upstream version numbers, coordinating them |
| 69 |
>> > > > > > into our downstream version numbers for all sources, checking to see if the |
| 70 |
>> > > > > > sources are effected, figuring out who to CC for the bugs, then harassing |
| 71 |
>> > > > > > them until they do it. |
| 72 |
>> > > > > > |
| 73 |
>> > > > > > Unlike other security sources, any attempt to hardmask the package is shutdown |
| 74 |
>> > > > > > instantly. The chaos that would result from a kernel hardmask, even one of |
| 75 |
>> > > > > > the lesser used ones, caused me to only successfully order one over my entire |
| 76 |
>> > > > > > career in Gentoo Kernsec... even though more around 30 would have been |
| 77 |
>> > > > > > needed. It is not infrequently that bugs will last six months without any |
| 78 |
>> > > > > > action coming about them, and users are blissfully unaware. |
| 79 |
>> > > > > > |
| 80 |
>> > > > > > I am happy to give my input as the former head of Kernel Security, but it is |
| 81 |
>> > > > > > my personal opinion that any advances in kernel security will require the |
| 82 |
>> > > > > > full cooperation of security, and letting the head of kernel security be able |
| 83 |
>> > > > > > to actually enforce threats, as that seems to be the only way bugs ever get |
| 84 |
>> > > > > > resolved. Pleading didn't work - I tried. |
| 85 |
>> > > > > > |
| 86 |
>> > > > > > -Harlan Lieberman-Berg |
| 87 |
>> > > > > > Gentoo Developer Emeritus |
| 88 |
>> > > > > |
| 89 |
>> > > > > |
| 90 |
>> > > > > Every word of what you said is painfully true. The only way to |
| 91 |
>> > > > > accomplish this would be with an Iron Fist(fail) or a team of ~15 guys |
| 92 |
>> > > > > who do nothing but patch and push new kernels and the PR that goes along |
| 93 |
>> > > > > with them every few days. |
| 94 |
>> > > > > -- |
| 95 |
>> > > > > Ned Ludd <solar@g.o> |
| 96 |
>> > > > > |
| 97 |
>> > > > > |
| 98 |
>> > > > > |
| 99 |
>> > > > > -- |
| 100 |
>> > > > > gentoo-security@l.g.o mailing list |
| 101 |
>> > > > > |
| 102 |
>> > > > > |
| 103 |
>> > > > -- |
| 104 |
>> > > > gentoo-security@l.g.o mailing list |
| 105 |
>> > > > |
| 106 |
>> > > > |
| 107 |
>> > |
| 108 |
>> > -- |
| 109 |
>> > gentoo-security@l.g.o mailing list |
| 110 |
>> |
| 111 |
>> -- |
| 112 |
>> Arthur Bispo de Castro |
| 113 |
>> Laboratório de Administração e Segurança (LAS/IC) |
| 114 |
>> Universidade Estadual de Campinas (UNICAMP) |
| 115 |
>> -- |
| 116 |
>> |
| 117 |
>> |
| 118 |
>> gentoo-security@l.g.o mailing list |
| 119 |
>> |
| 120 |
>> |
| 121 |
> |
| 122 |
> |
| 123 |
> |
| 124 |
|
| 125 |
-- |
| 126 |
gentoo-security@l.g.o mailing list |
Archives