Date: Wed, 27 Sep 2017 17:09:18 +0200 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: Linux kernel CVEs not mentioned on oss-security On Mon, Sep 25, 2017 at 09:50:59PM +0000, Priedhorsky, Reid wrote: > 1. Is oss-security's coverage of security issues in open-source software intended to be comprehensive? As others have said, no. (I think that would be an unrealistic goal. It could also result in so much traffic we'd have to think of splitting the list e.g. into notifications vs. discussions, but arguably that would be a good problem to have.) However, I would like the coverage to increase. When e.g. Debian sends out a security advisory, they shouldn't literally post it in here. We had asked (in list content guidelines) for distro-specific advisories not to be sent in here, for good reasons. However, if Debian and any other distros doing similar have the resources, I'd appreciate it if they bring in here info on vulnerabilities in Open Source software that they're tracking / are about to patch / have already patched / have even issued advisories on, but that haven't been mentioned in here before. Many distros (and/or people from distros' security teams) have been doing just that from time to time, but certainly not consistently. Maybe my encouragement above will help improve this? Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.