Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 6 Jul 2017 22:09:08 +0200
From: Kristian Fiskerstrand <>
To:, Solar Designer <>
Subject: Re: accepting new members to (linux-)distros lists

On 06/30/2017 03:22 PM, Solar Designer wrote:
> This is now up to 22 items: I've split one in two, and added three more.
> The full list is at:
> No volunteers so far?  I know some of you are actually helping with
> these, but I'd prefer that you explicitly take responsibility for them.

Gentoo is offering to take all, or a subset of, [9, 11 - 13] as primary
9. Stay on top of issues to ensure progress is being made, remind others
when there's no apparent progress, as well as when the public disclosure
date for an issue is approaching and when it's finally reached (unless
the reporter beats you to it by making their mandatory posting to
oss-security first)

11. Make sure the mandatory oss-security posting is made promptly and is
sufficiently detailed, and remind the reporter if not

12. If exploit(s) were shared on the list, make sure that either they're
included in the oss-security posting along with the issue detail or the
posting includes an announcement of planned later posting of the
exploits (with the delay being within list policy), and in the latter
case also make sure that the later posting is in fact made as planned,
and remind the reporter if not

13. Keep track of per-report and per-issue handling and disclosure
timelines (at least times of notification of the private list and of
actual public disclosure), at regular intervals produce and share
statistics (most notably, the average embargo duration) as well as the
raw data (except on issues that are still under embargo) by posting to

Kristian Fiskerstrand
OpenPGP keyblock reachable at hkp://
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.