[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 22 Dec 2013 14:34:07 +0400
From: Solar Designer <solar@...nwall.com>
To: nick@...edev.com
Cc: rubyonrails-security@...glegroups.com, oss-security@...ts.openwall.com,
tenderlove@...y-lang.org
Subject: Re: [CVE-2013-4491] Reflective XSS Vulnerability in Ruby on Rails
Hi all,
On Sun, Dec 22, 2013 at 01:29:58AM -0800, nick@...edev.com wrote:
> I am trying to upgrade but the suggested error handler doesn't work.
...
Are these followup postings still on topic for oss-security, or should
this possibly be discussed elsewhere and, if necessary and when ready,
summarized for/on oss-security as well (e.g., in the form of a revised
security advisory)? I am not sure, and as a co-moderator I am wondering
if/when we should start rejecting messages in this thread that are CC'ed
to oss-security by non-subscribers. I'd appreciate advice.
This is actually part of a more generic issue: whenever an upstream
project posts a security advisory CC'ed to that project's list(s) and to
oss-security, we often end up getting followup postings by users of the
project's software who are not into security and thus comment on
non-security aspects. This is sometimes fine and maybe even desirable,
but sometimes it gets too far off topic for oss-security, and it's often
difficult for moderators to decide when to start rejecting. A better
approach may be for upstream projects to be sending such announcements
to their lists and to oss-security separately, not by CC'ing.
(I actually asked OpenStack to start doing that a while ago, and I guess
they're doing it that way now.)
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
