Date: Mon, 14 Mar 2011 23:28:14 -0400 From: "Mike O'Connor" <mjo@...o.mi.org> To: oss-security@...ts.openwall.com Subject: Re: Vendor-sec hosting and future of closed lists [catching up on old email] :> > As suggested by Josh Bressers oCERT would be favourable to providing a :> > system that would accept user submission and allow selection of security :> > contacts from our existing member database as well as other verified :> > contacts. ... :It all depends on how this process is going to be handled. I can see oCERT :helping in routing reports to the proper contacts via email to our trusted :member contacts as well as external ones that we can seek on a report basis. What I've observed is that some times, the reporter or coordinator doesn't have a good idea of the scope of their issue. To cite some real-world examples involving folks who I thought would know better: 1) no, BSD networking isn't just in Free/Net/OpenBSD 2) no, ONC RPC just isn't in Sun products 3) no, a RH-specific kernel issue is a general Linux kernel issue Scoping issues isn't always easy. How do you know whether I backported some bleeding-edge fix with broken security implications into one of the OSes I care about last week? Sometimes, I'll need specific info just to confirm that I don't care about the issue. Scoping is one of the things that vendor-sec was occasionally quite helpful with. -- Michael J. O'Connor mjo@...o.mi.org =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--= "I'd be terrific! Colossal! Stupendous! Mediocre even!" -Babs Bunny
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.