Date: Mon, 25 Feb 2008 02:03:35 +0300 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: flaw disclosure (was: FAQ for upstream maintainers) On Wed, Feb 20, 2008 at 08:37:31AM -0500, Josh Bressers wrote: > I just created the namespace "disclosure" and added an outline I have to > them. I also added a note that the things in "whattodo" should be merged > into the namespace. I like the way you have approached this, and the initial content. Now we need to work on it more. Also, while I like the Researcher vs. Project distinction, we need to provide guidelines for the case when both a Researcher discloses a flaw to a Project, and a Project discloses the flaw to distributors. In this case, which is quite typical, it may be the Project's responsibility to communicate things such as embargo dates and credit "requirements" - or the Project may get the Researcher in touch with the distributors (e.g., vendor-sec) directly. > For the moment it's just my outlines, I've not gotten around to filling it > out yet. I did this, as I think it's important we have some amount of > organized information up, as this: > http://linsec.ca/blog/2008/02/17/new-informal-security-organization-oss-security/ > > Was just picked up by linuxsecurity.com Apparently, linuxsecurity.com is not that popular, and there was no direct link to our wiki from the linuxsecurity.com news item (the only link was via Vincent's blog). So we only got around 50 unique visitors per day for a while, and now we're down to 25 or so. Many of the visitors are actually exploring the wiki pages, though, so the number of page hits is 450 to 3500 per day - but much of that traffic could be from us, the list members. BTW, there are around 70 subscribers on this list now. Obviously, I expect a lot more visitors to the wiki and quite some more list members once we start to "advertise" this resource. > We will only get one look from a lot of people, and if they don't see > anything of value, they will likely never look again. This is probably true, but we have yet to get that first look from most people who might potentially be interested. Thanks, Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ