[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANTw=MOMnUyD89VQ9PBcoGgWevujBnwyuijbVFAEqsNv18KTGg@mail.gmail.com>
Date: Sun, 3 Mar 2013 15:06:09 -0500
From: Michael Gilbert <mgilbert@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: busybox
On Sun, Mar 3, 2013 at 2:50 PM, Kurt Seifried wrote:
> This actually raises a good point, due to Debian being a secondary
> source in most cases (e.g. upstream has a bug report which is then
> copied into Debian's bug tracker since Debian ships it) the dates and
> sometimes information is wrong.
Aren't these problems true for any source whether it be primary,
secondary, tertiary, or so on?
> I will no longer be issuing CVE's for
> issues brought up through the Debian bugtracker without an original
> source to back it up, otherwise more mistakes will happen which is not
> good.
I don't understand the purpose of excluding an entire project's
sources. Should redhat's bugzilla, gentoo, etc. also be excluded for
the same reason? If not, why do they get special treatment?
Is there really a problem at all? The debian report included the
upstream commit, so you had a link to a primary resource anyway. So,
I think a simple solution to this 'problem' of secondary sources is
follow them to the primary one?
Best wishes,
Mike
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
