Date: Tue, 5 Apr 2011 08:43:29 -0400 (EDT) From: Josh Bressers <bressers@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: Closed list ----- Original Message ----- > On Tue, Apr 05, 2011 at 07:19:08AM -0400, Josh Bressers wrote: > > Not adding Apple to any coordination list would be plain silly. They > > were far more active than most of the distributions. > > Yes. But why do they need to be aware, say, of glibc vulnerabilities > (ones that are in fact believed to be glibc-specific)? This is an excellent point. It's a hard problem to solve honestly. I guess the question really comes down to this. Do the disadvantages of one list outweigh the benefits? I'm not sure what the answer is. There probably isn't an "answer" though, just lots of opinions. > > > I'm starting to worry we've created rules for the sake of rules, which > > almost never has a net positive outcome. > > What do you propose? Go back to a vendor-sec style list, open to anyone > who is approved by other list members, and accept the accusations of > being subjective in who we subscribe? I can set one up alongside the > Linux distros list... then let the senders decide which list they want. > I don't have a proposal right now, which is why I'm glad we're having this discussion. I guess at the end of the day it comes down to the projects and reporters. Thinking in this regard, I think there could be advantages to having multiple lists with people subscribed to the various groups they belong, then the projects and researchers decide how they want their information distributed. This is why I like the idea of the membership list being public, it's makes it quite clear who would be receiving the information in question. We're really talking about a group that's a service to reporters, not the distributions or vendors. We want to make it easy for researchers and projects who approve of embargoes to work with us, and allow us to work with them in return. Thanks. -- JB
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.