The only plausible solution people have found to this problem is
"letting the world know", so everyone involved in the different stages
of IT maintenance can do their part and properly spread the solution
throughout the assets.
Unless you have a better idea, the full-disclosure policy must remain or
we're going back into 1992AD -- except the threats are thereof 2008.
Either someone classify and inform it as it is, a *security problem*, or
the issue is likely to pass unnoticed by the majority or to not receive
the necessary attention by the involved parts.
Right. You don't want your developers to be responsible for classifying
bugs towards security. Fine. Even though my intuition and personal
experience tell that the question must be approached by those deeply
involved in the development life-cycle, which, on their side, are
responsible for finding, classifying, advising and fixing the security
issues. This seems appropriate. Further, this appears to be what the big
software houses nowadays do: from early design and development stages,
have people to [security] review their applications before deployment,
up to giving high attention and adequate support to any reported
security problem, afterwards release. Maybe this is all silly and the
world is swimming in the wrong direction.
Opinions apart, what really matters: we have an ultimate declaration
about Linus' tree -- we may forget the pre-official (?) announcement
[Documentation/SecurityBugs] and know that someone else must,
eventually, classify and inform the world about security bugs existent
in their software.
From our consumer side, every time an issue of this nature is found,
let's pray for some intermediate, gray, angel to send us an "warning"
message.
Not more I can do but to make sure that all my peers are informed of
such a grave reality.
Sincerely,
Tiago
--
