oss-security - CC'ing external lists/bugs (Re: Bug#771125: Info received (CVE request: mutt: heap-based buffer overflow in mutt

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 27 Nov 2014 18:19:18 +0300
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: CC'ing external lists/bugs (Re: Bug#771125: Info received (CVE request: mutt: heap-based buffer overflow in mutt_substrdup()))

On Thu, Nov 27, 2014 at 04:15:10AM +0000, Debian Bug Tracking System wrote:
> Thank you for the additional information you have supplied regarding
> this Bug report.
[...]
> Please do not send mail to owner@...s.debian.org unless you wish
> to report a problem with the Bug-tracking system.

We have this problem when someone CC's a Debian bug on oss-security
postings.  (But somehow not all the time?  Perhaps the Debian bug
tracker has some rules for when not to notify of "the additional
information"?  Or was Reply-To or whatever set differently this time?)

Neither approving nor rejecting these messages feels right.  Rejecting
currently means a message would be sent to owner@...s.debian.org, and
also the thread might be broken in mailing list archives.  Doing nothing
means that a message to that extent would be sent a few days later.
I can SSH in to the server and manually remove the message from the
moderation queue to avoid that, but this also feels weird.  Well, or I
can update the spam filter to catch and drop these before they get to
the mailing list manager (and hence before moderation) - maybe I should.

Besides, any CC's to other lists tend to result in some "noise" being
sent to oss-security (some messages that would be appropriate for the
other instance of the thread, but not so much for oss-security).

So I am posting this for three reasons:

1. To ask that we please cut down on use of CC's to external lists.

2. To point out and ask about the issue with Debian bugs specifically -
how do we handle it best going forward?  Any suggestions?

3. To explain why this undesirable message appeared in here.

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.