So the only value withheld was the full description of the vulnerability, how it was found, how it was fixed, etc. Overall, we are happy to see a pre-release, rather than no information at all, before details of new vulnerabilities are discussed in a conference setting. On the other hand, it is essential that such pre-releases provide patches or links to fixed versions of the vulnerable software, both to allow people to secure their systems and to provide a means of verifying the existence of the vulnerabilities. Linux Security Module Project update . On this week's kernel page , Jonathan Corbet takes a look at the Linux Security Module Project, why it exists and how it is implemented.
Incoherent law is unpredictable.
Richard Forno has published an article that takes a look at the changing face of CERT . Also addressing the recent changes at CERT is this article at The Register. Security updates for Linux-Mandrake 7.0 and earlier discontinued . Security Reports Multiple security fixes in OpenSSL-0.9.6a . Jim Knoble dropped a note to BugTraq this week pointing out that OpenSSL-0.9.6a was announced this week and contains fixes for four security issues.