Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 4 Apr 2011 02:57:54 +0400
From: Solar Designer <>
Subject: Re: Closed list

On Fri, Apr 01, 2011 at 10:13:05PM -0400, Mike O'Connor wrote:
> I use my personal address rather than my work address for handling
> vendor security matters because:

Thank you for explaining this in here.

> The vetting should be about more than email domains.  There should be
> periodic maintenance of who's on the list to cull out those who aren't
> involved.  Marcus did that to some degree with the vendor-sec of old.


> I think the biggest problems there were the exploders and the lack of
> encryption,

Maybe (re: "biggest").

> and both of those are being addressed with this new list
> as I understand things.

Yes, they are.

> I think that having a couple lists, one for "tactical" issues (e.g.
> embargoes and CVE assignment) and another for "strategic" discussions
> (e.g. "how to deal with vagaries in gcc vs. C standards with general
> security impact") may be appropriate.  I'm part of another security
> community which has such a notion, and it seems to help in keeping
> things focused, FWIW.

It appears that this is what we will have, but I am starting with one
list that is more obviously needed (alternative to CC lists).

Your specific example re: "how to deal with vagaries in gcc vs. C
standards with general security impact" would be best discussed on
oss-security (that is, on a public list), though.  It does not benefit
from a short embargo, and long embargoes are inappropriate.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.