Date: Fri, 14 Jul 2017 19:56:07 +0200 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: accepting new members to (linux-)distros lists On Sat, Jul 08, 2017 at 04:11:25PM +0200, Salvatore Bonaccorso wrote: > On Wed, Jun 28, 2017 at 10:02:40PM +0200, Solar Designer wrote: > > 6. If CVE IDs are requested, the report is valid, and you're a CNA, > > assign those (requesting any required information from the reporter > > first) > > > > 7. If the report does not mention CVE IDs (neither requests nor provides > > them, and doesn't mention the reporter having requested them elsewhere), > > yet the report is valid and it looks like distros will need CVE IDs, and > > you're a CNA, ask the reporter whether they have already requested CVE > > IDs elsewhere, then assign those if they haven't been requested > > elsewhere > > Speaking for Debian: Debian beeing a CNA can *help* monitoring those > explicitly and assign where needed CVEs from the assigned pool. I've listed Debian as backup for the two CVE tasks above. I've also listed Red Hat as primary for these two tasks, based on Red Hat's contributions so far. And I've listed Cloud Linux and Gentoo beside the tasks they kindly volunteered for in postings in here. I see that Gentoo is already active at their tasks, including reminding reporters to post to oss-security and taking care of the SPICE posting (when the reporter wasn't available to make it on time): http://www.openwall.com/lists/oss-security/2017/07/14/1 as well as collecting statistics. Thanks! > We are already as well contributing to other tasks, and will continue > to do so as time permits. Thank you! However, many tasks remain vacant, with no distro responsible for them. This doesn't mean they're not getting done - just that no particular distro is responsible - yet that's something I'd like to see change. Specifically, all 6 of the technical tasks and 5 of 13 administrative tasks are now fully vacant. Additionally, 11 of the administrative tasks have no backup. These distros have no task assigned: ALT Linux, Amazon Linux AMI, Arch Linux, Chrome OS, Openwall, Oracle, Slackware, SUSE, Ubuntu, Wind River, FreeBSD, NetBSD/pkgsrc. Openwall might be exempt for now for us running the lists and being the last resort fallback for most tasks. ;-) The rest should volunteer for some tasks now! Red Hat almost made this list, except that I listed them for the two CVE tasks on my own. http://oss-security.openwall.org/wiki/mailing-lists/distros#contributing-back Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.