Re: [Xen-devel] Security vulnerability process, and CVE-2012-0217

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

On Fri, 2012-06-29 at 11:01 +0100, George Dunlap wrote:
> On Wed, Jun 27, 2012 at 7:07 PM, Thomas Goirand <thomas@xxxxxxxxxx> wrote:
> > On 06/20/2012 05:45 PM, George Dunlap wrote:
> >> The only way this would work is if the predisclosure list consisted
> >> exclusively of software providers, and specifically excluded service
> >> providers.
> > I agree, though you might have corner cases.
> >
> > What if you are *both* software and service provider (eg: I'm working on
> > Debian and XCP, and my small company provides a hosted Xen service)?
> 
> If we do make a rule that only software providers can be on the list,
> and not service providers, then ideally you should try to separate the
> roles.  If you are on the list as a software provider, you should use
> that information only to prepare patches; but not deploy them on your
> own systems until the embargo date.
> 
> In a way, the question is very similar to asking, "I'm working on
> Debian and XCP, and my best friend owns a small company that provides
> a hosted Xen service."  If you told your friend about the
> vulnerability, you would be breaking the security embargo (and giving
> your friend an unfair advantage over other hosting services), and
> would be at risk of being removed from the list if someone found out.
> If you wear two "hats", as it were, the same would be true if your
> developer "hat" told your service provider "hat": actually updating
> your systems before the embargo would (I think) be considered breaking
> the embargo, and would be giving yourself an unfair advantage over
> other hosting services.
> 
> (All of the above discussion is, of course, only valid in the
> hypothetical situation that we don't allow service providers to be on
> the list.)

It also supposes that there would be some way to police this separation
-- how could you tell if a software vendor had given unfair advantage to
their friends, and how could you tell which one it was in order to
"punish" them?

The same problem exists if you allow service providers but insist that a
condition of membership is that they use the pre-disclosure period to
"prepare but not deploy" (i.e. to keep their hats separate). Other than
a suspicious wave of reboots across that providers infrastructure
(attributed to "routine maintenance") how would you know?

> 
>  -George
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxx
> http://lists.xen.org/xen-devel



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel