Date: Mon, 15 Feb 2016 18:18:47 +0300 From: Solar Designer <solar@...nwall.com> To: David Leo <httpsonly.github.io@...il.com> Cc: oss-security@...ts.openwall.com Subject: Re: Browser Security Tool: HTTPS Only (Why, How, Open Source, Python) On Sun, Feb 14, 2016 at 10:07:21PM -0500, David Leo wrote: > (@...erators The original post was too brief. This one has details.) As a moderator for oss-security, I was torn between rejecting this message and using it as an example of what (not) to post in here. I chose the latter. There are few tool announcements in here. I think we want more, but I also think we want them to be more relevant to this particular list and very infrequent for any one particular tool. For most, it should be just one initial announcement and that's all - no updates - unless the tool is particularly relevant (e.g., a static analyzer, a fuzzer, or a generic privsep library) or the update is particularly major (especially if it's been years since the previous announcement). To make this policy explicit, and to actually invite the desirable kind of content, I've just added this: "Occasional announcements of Open Source security tools (and relevant features of non-security tools) are acceptable, but only for initial announcements and major updates (not for minor updates). Especially desirable are news on tools/features aimed to enhance security of other Open Source software." to: http://oss-security.openwall.org/wiki/mailing-lists/oss-security#list-content-guidelines We also previously had: "Please don't cross-post messages to oss-security and other mailing lists at once, especially not to high-volume lists such as LKML and netdev, as this tends to result in threads that wander partially or fully off-topic (e.g., Linux kernel coding style detail may end up being discussed in comments to a patch posted to LKML, but it would be off-topic for oss-security). If you feel that something needs to be posted to oss-security and to another list, please make separate postings. You may mention the other posting(s) in your oss-security posting, and even link to other lists' archives." We generally don't reject oss-security postings for CC's to other lists, in part because the problem (if any) is usually not with the original posting's content, but with the follow-ups that the CC's invite from other lists, which we have no control of (even if we reject the message, it may get through to the CC'ed lists). However, we ask that senders please avoid CC's (except to upstream developers, etc., which is OK). While having Bugtraq or/and FD CC'ed is not as bad as having LKML CC'ed (due to those lists also having a security focus, unlike LKML), it is not welcome. (For LKML in particular, it's totally different for the kernel-hardening list, also hosted by Openwall. On that list, CC'ing LKML is the norm.) Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ