Date: Thu, 20 Aug 2015 00:42:25 +0300 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: CVE REJECT noise All - Can we please agree that CVE REJECT postings such as those Kurt has been occasionally making in here for a while are not to be made anymore? To me, and I suspect to almost(?) all other oss-security subscribers, they are just noise. I mean things like this: http://www.openwall.com/lists/oss-security/2015/08/18/9 "Subject: CVE REJECT CVE-2015-5192/CVE-2015-5193 Please CVE REJECT CVE-2015-5192/CVE-2015-5193 I misread a request and assigned CVE's twice to two issues, so one set needs to be rejected." I am fine with postings that talk in some detail about issues that are already public and also mention that a CVE ID should be rejected. I am not fine with postings the only purpose of which is to announce that a CVE ID is being rejected, especially if those postings fail to mention the product and the vulnerability. I understand that for CVE IDs assigned in private to issues that are not yet public it would be inappropriate to include this detail in a public posting, but to me this also means that a public posting shouldn't be made. I did bring this up with Kurt in private e-mail a few months ago, and Kurt responded with some arguments in favor of continuing this practice. Yet I think it has to end. If anyone on this list besides Kurt thinks otherwise, please let us all know and explain why you personally found those postings useful. Otherwise I'll consider it a decision made, and will expect no further postings of this sort. Thanks, Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ