Hackers don't give a shit about your change control, they're not going to give you a head start because you're slow to respond to threats.

How does not telling anyone that people are actively exploiting this change that?

I think it is probably a bad idea to rely on the expensive patent process to protect open source. Isn't it better to make the software available and visible so that it can be clearly established that it is prior art, i.e. already known by all, when someone tries to patent drawing rectangles on the screen, or whatever? I'm probably ignorant, but what's wrong with that approach? Is it less certain to succeed in a court, or is it possible to patent something that someone else has already done and explained how to do?

Sorry for being dense, but how does that verify that my vote is affecting the the announced result of the election? Couldn't they just announce "X got 60% of the votes" anyway? (By jamming in a lot of false ballots, or by just lying?)

Odd question.

I don't know about three days, but certainly under a week, which is completely normal in free software. Proprietary vendors generally want between six months and two years, but free software vendors and projects very rarely ask for more than a week or two delay before publication.

In fact, Linus famously tells people not to tell him about any security issue you want kept secret for more than a week, as he will just go ahead and fix it.

Odd, I don't know why you're picking on me, but I assume "Android Kernel" is marketing-speak for "Linux", in which I've reported found and fixes dozens of flaws over the years.

As you're so interested, here are some from the last month or two that you can take a look at.

CVE-2010-3080, A use-after-free in snd_seq_oss_open
CVE-2010-2960, A to-userspace dereference in keyctl_session_to_parent.
CVE-2010-2954, Kernel panic and to-userspace dereference in AF_IRDA sockets.
CVE-2010-3067, Various problems with aio (things like aio_submit())

The coverity results I've seen in the past are generally very low quality with a high density of chaff. I haven't seen the report they're talking about, but would be surprised if there were any noteworthy findings with any significant security impact. The only report I've seen them publish that had any convincing vulnerabilities was in 2006, where they found a verifiable privilege escalation in XFree86 (due to a pretty horrendous typo).

I'm a little saddened that you so readily associate me with Windows security, where as I consider myself primarily a Linux security developer, but I guess I'm flattered that where I spend my time is so important to you.

(perhaps a little creepy, though).

It's easy: car pool!
With two people in the car, the amount of useful work* is doubled!
* = hauling people around, as opposed to hauling a large heavy metal box around
A fundamental problem about cars and energy efficiency is not about the engine, or how to improve its efficiency with 20% or so, it is about how we construct our societies, roads, public and goods transportation. When we build ourselves into a car centric, there is really isn't that much we can do to reduce our energy consumption.

This very useful comment was found in TFA.

Perhaps this microwave-proof clothing works?

You didn't elect me your doctor either, but I'm sure you would like me to tell you if you water supply was poisoned.

Actually, his comment was entirely accurate.

I've reported dozens of critical vulnerabilities in Microsoft software over the years, and I still have multiple open cases with Microsoft security, this particular case wasn't as simple as you have assumed. I would not be so presumptuous to explain the ethics of your work to you, but evidently you believe you're qualified to lecture me in mine.

If I were to read the sensationalised lay-press coverage of your latest publication or project, would it prepare me to write a critique of your
work?

Yes, cocaine has that effect on some people. http://www.youtube.com/watch?v=wvsboPUjrGc

Actually, your idea that he shouldn't reveal atrocities because he was ordered not to has not been in vogue since the Nuremberg trials.

Applications Welcome ;-)

I'm more concerned about invisible sharks with lasers on their heads.