Date: Thu, 21 Mar 2013 14:05:13 +0000 From: "Christey, Steven M." <coley@...re.org> To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>, "larry Cashdollar" <larry0@...com> CC: "kseifried@...hat.com" <kseifried@...hat.com> Subject: RE: Ruby CVEs I agree with Alexander. The CVE assignment process is never intended to introduce unnecessary delays to the publication of vulnerability information. Merely noting whether CVEs have already been requested should reduce most of the risk of duplicates without forcing people to delay publication. - Steve >-----Original Message----- >From: Solar Designer [mailto:solar@...nwall.com] >Sent: Wednesday, March 20, 2013 10:58 PM >To: larry Cashdollar >Cc: oss-security@...ts.openwall.com; kseifried@...hat.com >Subject: Re: [oss-security] Ruby CVEs > >[snip] >Overall, I think all of you have tried to do the right thing, and I >would not want to have information withheld from this list merely to >avoid duplicate CVE IDs in the future. CVEs are handy, but the CVE >assignment process should not affect what is posted publicly and when.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.