Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Sep 2017 17:09:18 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel CVEs not mentioned on oss-security

On Mon, Sep 25, 2017 at 09:50:59PM +0000, Priedhorsky, Reid wrote:
> 1. Is oss-security's coverage of security issues in open-source software intended to be comprehensive?

As others have said, no.  (I think that would be an unrealistic goal.
It could also result in so much traffic we'd have to think of splitting
the list e.g. into notifications vs. discussions, but arguably that
would be a good problem to have.)

However, I would like the coverage to increase.  When e.g. Debian
sends out a security advisory, they shouldn't literally post it in here.
We had asked (in list content guidelines) for distro-specific advisories
not to be sent in here, for good reasons.  However, if Debian and any
other distros doing similar have the resources, I'd appreciate it if
they bring in here info on vulnerabilities in Open Source software that
they're tracking / are about to patch / have already patched / have even
issued advisories on, but that haven't been mentioned in here before.

Many distros (and/or people from distros' security teams) have been
doing just that from time to time, but certainly not consistently.

Maybe my encouragement above will help improve this?

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ