Date: Thu, 31 May 2018 20:55:28 +0200 From: Solar Designer <solar@...nwall.com> To: Stefan Kanthak <stefan.kanthak@...go.de> Cc: Pete Batard <pete@...o.ie>, oss-security@...ts.openwall.com Subject: Re: CVE request: rufus Stefan, Pete - As a moderator for oss-security, I approved these messages for their technical substance, but I don't appreciate the personal (counter-)attacks. Let's please refrain from discussing people's experience, behavior, etc. and focus solely on the technical issues. (Unfortunately, when I say this I do point out an issue with behavior, but only as it relates to what I'd like not to see on this list. I don't judge what's appropriate or not in general; I only set the policy here.) On Thu, May 31, 2018 at 08:04:52PM +0200, Stefan Kanthak wrote: > READ THE SUBJECT! > Hint: it reads "CVE request". oss-security is no longer a place to make CVE requests. Please see: http://oss-security.openwall.org/wiki/mailing-lists/oss-security#cve-requests "Previously, one could request CVE IDs for issues in Open Source software from oss-security. This is no longer the case. Instead, please start by posting about the (to be made) public issue to oss-security (without a CVE ID), request a CVE ID from MITRE directly, and finally "reply" to your own posting when you also have the CVE ID to add. With the described approach you would only approach MITRE after the issue is already public, but if you choose to do things differently and contact MITRE about an issue that is not yet public, then please do not disclose to them more than the absolute minimum needed for them to assign a CVE ID." When the occasional CVE request messages that still arrive in here are otherwise on topic, like this time, we approve those anyway for their content. If a CVE ID is desired, the sender is then expected to follow the above procedure. Thanks, Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ