Date: Fri, 03 Feb 2012 10:02:16 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Ian Campbell <ijc@....org> Subject: Re: Adding Xen.org contact to linux-distros security list On 02/03/2012 02:33 AM, Ian Campbell wrote: > Hello, > > Would it be possible for myself to be subscribed to the linux-distros > security list as a representative of Xen.org? > > Although Xen.org is not a distro we do incorporate upstream software and > one of our upstreams (qemu) uses this list as their embargoed security > announcement channel. We would like to be able to co-ordinate the > release of fixes into our own qemu trees. > > Many thanks, > > Ian. I think this is something that should be discussed (I'm not specifically against Xen joining, but I'm worried about the precedent it might set). Many projects incorporate upstream software, if we lower the bar of entry in this respect we may get a lot more people on the list. This might not be a good idea (more chances of leaks/etc.). My understanding of the way the vs security list is used is that upstream is typically notified (after all, they usually are the ones fixing the issue), and that people not on the list can post to the list to notify it of upcoming stuff (this happens all the time), we then CC them on communications about the issue they reported to keep them in the loop. For something this specific might it not be a better idea for Xen just go straight to the qemu project so they can be notified of the embargoed issues? -- Kurt Seifried Red Hat Security Response Team (SRT)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.