Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 22 May 2017 19:17:02 -0700
From: Kurt H Maier <>
Subject: Re: How to request a CVE for open source projects

On Mon, May 22, 2017 at 08:04:41PM -0600, Kurt Seifried wrote:
> I disagree. If not assigning CVE's on the list kills this list, then...
> wow. Good to know I personally kept this list up and running for a few
> years.

Nobody said that, and I haven't said anything that wasn't said when this
change was first dropped on us.  The difference you're talking around is
that vulnerabilities used to appear on this list of necessity, and now
we either have to hope reporters cross-post or else monitor some number
of different databases and post everything ourselves.  If you'll recall,
this is why it was suggested that non-embargoed webforum submissions
automatically post here.  

But it's clear nobody was interested in making that happen, and now we
get a pile of infrastructure instead.  Que sera sera, but I stand by 
the opinion that the new processes have lost something along the way.

> Which README specifically (there's a bunch), feel free to reply offlist.

I've submitted a pull request, since that seems to be the primary form
of human communication now.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.