Date: Fri, 20 Mar 2015 12:28:28 -0400 From: Daniel Micay <danielmicay@...il.com> To: oss-security@...ts.openwall.com Subject: Re: membership request to the closed linux-distros security mailing list On 20/03/15 12:05 PM, Anthony Liguori wrote: > > Upstreams are already free to do this, no? If an upstream reporter > sends to distros@ or another forum, they have already made that > risk/reward trade-off. I would expect that people are reporting vulnerabilities to the list because they see it as the most responsible form of disclosure. I don't think they're in the position to make an accurate risk/reward trade-off though. There's little information on how the distributions are making use of this information. I don't think many people would be reporting bugs to it if they knew the answer to that question... The distros subscribed to the list are in the position to state whether it's helping them minimize the delay between disclosure and shipping a patch or whether it's simply tying their hands for more time. I'm sure it's a mix of both, but I'd like to hear from them. For most vulnerabilities, I doubt that having early notice is at all helpful. The important factor is that there's a working patch out of the gate from upstream and ideally new point releases for any of the supported versions. It's just a artificial delay before shipping a patch can happen. IMO, only distributions with ancient versions where the patches don't apply cleanly are going to benefit. There's also the possibility of related issues, but upstream and the discover of the issues are in the best position to find those. Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.