3 ms·

Why do the major Xen providers get advance access to the patches while my machines have to sit vulnerable for over a week?

by gnu8 12y ago

eloff 12y ago
Presumably because making the patch public also makes the vulnerability public and they want to give the big players time to protect their customers.
jmiwhite 12y ago
This is explained in the Xen security policy, from the 'Embargo and disclosure schedule' heading. http://www.xenproject.org/security-policy.html http://www.xenproject.org/security-policy.html
danielweber 12y ago
Because responsible adults have demonstrated their ability to follow a coordinated disclosure policy which lets them improve their own security without harming anyone else's.
hiou 12y ago
From what I understand, the bar to get on the pre-disclosure list is not high. If you are a legitimate company serving the public you will likely qualify.
tptacek 12y ago
One working week between notification arriving at security@xenproject and the issue of our own advisory to our predisclosure list. We will use this time to gather information and prepare our advisory, including required patches. Two working weeks between issue of our advisory to our predisclosure list and publication. When a discoverer reports a problem to us and requests longer delays than we would consider ideal, we will honour such a request if reasonable. If a discoverer wants an accelerated disclosure compared to what we would prefer, we naturally do not have the power to insist that a discoverer waits for us to be ready and will honour the date specified by the discoverer. Naturally, if a vulnerability is being exploited in the wild we will make immediately public release of the advisory and patch(es) and expect others to do likewise. This is an extraordinarily aggressive (in a good way) and transparent process. Big commercial vendors routinely sit on vulnerabilities for months.

Why do the major Xen providers get advance access to the patches while my machines have to sit vulnerable for over a week?

by gnu8 12y ago

Why do the major Xen providers get advance access to the patches while my machines have to sit vulnerable for over a week?

eloff 12y ago

Presumably because making the patch public also makes the vulnerability public and they want to give the big players time to protect their customers.

jmiwhite 12y ago

This is explained in the Xen security policy, from the 'Embargo and disclosure schedule' heading. http://www.xenproject.org/security-policy.html http://www.xenproject.org/security-policy.html

danielweber 12y ago

Because responsible adults have demonstrated their ability to follow a coordinated disclosure policy which lets them improve their own security without harming anyone else's.

hiou 12y ago

From what I understand, the bar to get on the pre-disclosure list is not high. If you are a legitimate company serving the public you will likely qualify.

tptacek 12y ago

One working week between notification arriving at security@xenproject and the issue of our own advisory to our predisclosure list. We will use this time to gather information and prepare our advisory, including required patches. Two working weeks between issue of our advisory to our predisclosure list and publication. When a discoverer reports a problem to us and requests longer delays than we would consider ideal, we will honour such a request if reasonable. If a discoverer wants an accelerated disclosure compared to what we would prefer, we naturally do not have the power to insist that a discoverer waits for us to be ready and will honour the date specified by the discoverer. Naturally, if a vulnerability is being exploited in the wild we will make immediately public release of the advisory and patch(es) and expect others to do likewise. This is an extraordinarily aggressive (in a good way) and transparent process. Big commercial vendors routinely sit on vulnerabilities for months.