[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 13 Apr 2011 06:51:02 -1000
From: akuster <akuster@...sta.com>
To: Dan Rosenberg <dan.j.rosenberg@...il.com>
CC: oss-security@...ts.openwall.com, Josh Bressers <bressers@...hat.com>
Subject: Re: Closed list
Dan,
I personally want a public list but its more of an internal Company
philosophy / process issue and more importantly what our customers
think. There could even be contractual issues involved.
If one would look at our customer list, I think one could indirectly
determine that we would have to provide security fixes (
http://mvista.com/customers.php ).
How do I meet the requirement of "Proof"?
- Armin
On 04/13/2011 06:19 AM, Dan Rosenberg wrote:
> Hi Armin,
>
>> What method of proving this would be acceptable? screen shot, temporary
>> access to our site, public list or other?
>>
>
> I'm confused why you think posting an advisory publicly would somehow
> put your customers in any sort of additional danger. All of the
> vulnerabilities you would be fixing are certain to have public
> advisories for other distributions, so it seems obvious that your
> customers would be affected also. It's not as though your advisories
> are the only indication to an attacker that your customers are
> vulnerable.
>
> Regards,
> Dan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
