[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Mar 2015 12:28:28 -0400
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: membership request to the closed linux-distros
security mailing list
On 20/03/15 12:05 PM, Anthony Liguori wrote:
>
> Upstreams are already free to do this, no? If an upstream reporter
> sends to distros@ or another forum, they have already made that
> risk/reward trade-off.
I would expect that people are reporting vulnerabilities to the list
because they see it as the most responsible form of disclosure. I don't
think they're in the position to make an accurate risk/reward trade-off
though. There's little information on how the distributions are making
use of this information. I don't think many people would be reporting
bugs to it if they knew the answer to that question...
The distros subscribed to the list are in the position to state whether
it's helping them minimize the delay between disclosure and shipping a
patch or whether it's simply tying their hands for more time. I'm sure
it's a mix of both, but I'd like to hear from them.
For most vulnerabilities, I doubt that having early notice is at all
helpful. The important factor is that there's a working patch out of the
gate from upstream and ideally new point releases for any of the
supported versions.
It's just a artificial delay before shipping a patch can happen. IMO,
only distributions with ancient versions where the patches don't apply
cleanly are going to benefit. There's also the possibility of related
issues, but upstream and the discover of the issues are in the best
position to find those.
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
