[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 19 May 2022 12:52:38 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com, Dan Carpenter <dan.carpenter@...cle.com>
Subject: Re: linux-distros list policy and Linux kernel
On 5/19/22 05:41, Dan Carpenter wrote:
> I don't know how to distributions do embargos and I don't want to be a
> part of that discussion. If I started disclosing bugs then I would be
> a part of a discussion I'm trying to avoid.
>
> I'm pretty sure a lot of employers have policy about disclosing
> vulnerabilities. I've never disclosed a vulnerability so I don't know
> Oracle's policy. Possibly sending an email to oss-security could get
> me fired???
If you wanted to be in that position, you could take steps to be able to
do so without getting fired. Oracle sanctions my participation in the
X.Org Security Team, including my disclosure of security fixes in X.Org's
open source projects to public forums including oss-security following X.Org's
security disclosure process. But I've also got over a decade of experience as
the Security Lead for Oracle Solaris and know exactly where the line is between
what I should and should not say on such forums, and have worked closely with
the Oracle people who decide what should be said on security disclosures.
You can also see other Oracle folks here like John Haxby who know what they're
doing here.
But if, as you say, you don't want to be involved in that and learn all the
rules involved, that's not going to help you, and you should avoid disclosing
vulnerabilities yourself.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
