Date: Fri, 26 Jul 2019 13:07:44 +0200 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: Statistics for distros lists updated for 2019Q2 On Fri, Jul 26, 2019 at 12:25:47PM +0200, Kristian Fiskerstrand wrote: > On 26.07.2019 10:16, Solar Designer wrote: > > Now you have updated stats, but you've dropped all of the detail. :-( > > Please re-add it ASAP. > > Woops, had indeed overwritten wrong CSV file. Fixed :) Thanks! There's also Apache httpd CVE-2019-0211, which was first posted to oss-security and then (wrongly) brought to distros. You list it with negative embargo period of -0.24 days, which technically makes sense, but it probably skews the averages, which are meant to be for actual embargoes. Even if we set it to zero, it'd continue to skew the averages. So we should probably consistently exclude non-positive embargo periods from the calculation of averages. Will you, please? This brings up and leaves open the question of what to do with very short embargo periods like a few hours. My suggestion is that we continue to include them in the averages, but also add calculation and reporting of median embargo times (also excluding just the non-positive embargo periods from the calculation of the medians). Can you do it, please? The non-positive embargo periods should probably continue to be listed in the detail table, but a (foot)note should be added explaining that they're excluded from the calculations. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.