Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 2 Feb 2021 10:48:30 -0800
From: Anthony Liguori <>
To: Solar Designer <>, <>
Subject: Re: Gentoo's "contributing back" linux-distros tasks

Anthony Liguori <> writes:

> Solar Designer <> writes:
>> 13. Keep track of per-report and per-issue handling and disclosure
>> timelines (at least times of notification of the private list and of
>> actual public disclosure), at regular intervals produce and share
>> statistics (most notably, the average embargo duration) as well as the
>> raw data (except on issues that are still under embargo) by posting to
>> oss-security - primary: Gentoo, backup: Amazon
>> and we saw some contributions from Gentoo on these, most notable being
>> their work on the statistics (task 13 above):
>> Unfortunately, the last update of these statistics ("Last modified:
>> 2019/10/15 01:52 by kristianf") is also when the contributions ceased.

As part of planning on getting this going again, I want to just review
the cadence and update duration.

I think this is easiest to do on the 15th of every month for the
previous month.  As example, on 2/15, we would post the statistics for
February.  Since the maximum embargo duration is 2-weeks, this would not
disclose any embargoed information.

Does this seem reasonable?


Anthony Liguori

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.