Date: Thu, 14 Apr 2011 06:24:40 -1000 From: akuster <akuster@...sta.com> To: oss-security@...ts.openwall.com CC: Mike O'Connor <mjo@...o.mi.org> Subject: Re: Closed list On 04/13/2011 01:02 PM, Mike O'Connor wrote: > :----- Original Message ----- > For linux-distros, I think what you really want to go for here are > *timely* updates. If a distro isn't generally capable of producing a > security update within, say, a month of when the issue was released, > then their getting the issue in advance through linux-distros isn't > going to do them or their distro community a lot of good because they > have other constraints in getting fixes out the door. > Focusing on how > you think an update ought to *look* (e.g. should the advisories be > public?) isn't as important as the update getting *out*. Especially > since you're dealing with GPL'ed code, I think that's something you > can measure. Just ask the constituency a month or so after some major > kernel issue who has released updates/fixes and who hasn't, show the > relevant source, and take it from there. Where would one draw the line? If one is truly worried about security the units running the software need to validated (no suggesting this at all, completely impractical). Anyone up for going to Iraq to check our customer's units? How about Bob's house, Jill's car or outer-space? - Armin
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.