oss-security - CVE REJECT noise

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 20 Aug 2015 00:42:25 +0300
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: CVE REJECT noise

All -

Can we please agree that CVE REJECT postings such as those Kurt has been
occasionally making in here for a while are not to be made anymore?  To
me, and I suspect to almost(?) all other oss-security subscribers, they
are just noise.  I mean things like this:

http://www.openwall.com/lists/oss-security/2015/08/18/9

"Subject: CVE REJECT CVE-2015-5192/CVE-2015-5193

Please CVE REJECT CVE-2015-5192/CVE-2015-5193 I misread a request and
assigned CVE's twice to two issues, so one set needs to be rejected."

I am fine with postings that talk in some detail about issues that are
already public and also mention that a CVE ID should be rejected.  I am
not fine with postings the only purpose of which is to announce that a
CVE ID is being rejected, especially if those postings fail to mention
the product and the vulnerability.  I understand that for CVE IDs
assigned in private to issues that are not yet public it would be
inappropriate to include this detail in a public posting, but to me this
also means that a public posting shouldn't be made.

I did bring this up with Kurt in private e-mail a few months ago, and
Kurt responded with some arguments in favor of continuing this practice.
Yet I think it has to end.

If anyone on this list besides Kurt thinks otherwise, please let us all
know and explain why you personally found those postings useful.
Otherwise I'll consider it a decision made, and will expect no further
postings of this sort.

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.