Date: Fri, 31 Jan 2014 05:07:44 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: responsible use of distros and linux-distros lists (was: Linux kernel: fs: fix get_dumpable() incorrect tests (CVE-2013-2929)) On Fri, Jan 31, 2014 at 04:51:55AM +0400, Solar Designer wrote: > I'm afraid the issue below was never brought to oss-security (as it must > have been). The fix was committed on November 13: > > http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d049f74f2dbe71354d43d393ac3a188947811348 > > including detailed description and the CVE-2013-2929 reference. So it > was clearly disclosed as a security issue, yet bringing it to > oss-security specifically seems to have falled through the cracks. :-( Unfortunately, I was not watching closely enough to notice this did not(?) get to oss-security in time, so we got a nasty violation of linux-distros list policy here. Can those distros and linux-distros members who would like the lists to stay around please help police the lists, detecting and correcting such instances of negligence much sooner? Thanks! Timely posting to oss-security (yes, this one specific place) is important, because that way a distro (or anyone) who chooses not to join linux-distros (or distros, as appropriate) or is not accepted may nevertheless be confident they receive info on all the same issues once the issues are publicly disclosed, by being subscribed to oss-security. Fire-and-forget use of distros and linux-distros lists is inappropriate. By posting to one of these lists, you accept certain responsibility: http://oss-security.openwall.org/wiki/mailing-lists/distros#how-to-use-the-lists "When the security issue is finally to be made public, it is your (the original reporter's) responsibility to post about it to oss-security (indeed, you and others may also post to any other mailing lists, etc.)" If you're unwilling to accept that responsibility, please refrain from posting to those lists. Unfortunately, people sometimes don't read or ignore or forget about this requirement, or forget that they have sent something to the distros or linux-distros lists but not yet to oss-security - so let's be watching and reminding! (Or maybe we should automate the reminders. Or maybe we should automate the public disclosure. Or maybe we should shutdown the lists.) Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ