Date: Sun, 24 Apr 2011 16:36:11 +0400 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: Closed list On Fri, Apr 15, 2011 at 05:23:17AM +0000, Zhao, Zhenfeng wrote: > Now I use my own e-mail address instead of one exploder to apply for the membership, and I also have added Wind River info to the wiki pages. OK, I was a vendor-sec member representing Wind River, please add me to the new list. Thanks. Unfortunately, the info you have added puts you in the same category with MontaVista. We haven't yet decided on what to do with "closed" Linux vendors like this. There has been some opposition to them receiving advance notifications of security vulnerabilities via the new list because the community would not be able to tell whether such vendors are making intended use of the advance notifications or not. http://oss-security.openwall.org/wiki/vendors#wind-river "The process for receiving security advisories requires a Support or Maintenance subscription." As I wrote in another message, I am considering setting up a separate list that would include Linux vendors like this. Then message senders will be the ones to decide on which categories of vendors to inform. I consider both the existing new list and any other lists we might setup experimental. Everything is subject to change, even the very existence of these lists. We're merely trying to see what works best. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.