Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 14 Apr 2011 05:25:02 -1000
From: akuster <akuster@...sta.com>
To: oss-security@...ts.openwall.com
CC: Tomas Hoger <thoger@...hat.com>
Subject: Re: Closed list

Thomas,

Thanks for the feedback. That kind of list is what I had hoped MV could
have created a year ago. Resources shot it down then and now MV has
added a few more issues to work through.

If SUSE's http://support.novell.com/security/cve/ is an example of what
is being sot to meet the public advisory requirement, then I know what
MV needs to do.

Mahalo,
Armin

On 04/13/2011 10:38 PM, Tomas Hoger wrote:
> Hi Armin!
> 
> On Wed, 13 Apr 2011 05:59:20 -1000 akuster wrote:
> 
>>> It's clear that one of the membership requirements is now producing
>>> security updates. 
>>
>> What method of proving this would be acceptable? screen shot,
>> temporary access to our site, public list or other?
> 
> A quick idea, rather than a real guidance:  Several vendors offer some
> sort of public CVE database that can be used to search for vendor's
> updates to address particular flaw.  If you're already tagging your
> updates with CVE ids, this may not be hard to provide.  Not because
> folks on this list ask you to do so, but because it's likely to provide
> a significant benefit to your customers with little extra cost/effort on
> top of what you already do.
> 
> SUSE's database is probably closest to what may work for you as well.
> CVE info is split by a patched product+version, with links to
> customer-only download site for the enterprise products.
> 
> http://support.novell.com/security/cve/
> 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.