Date: Sun, 27 Aug 2023 10:23:45 -0700 From: Alan Coopersmith <alan.coopersmith@...cle.com> To: oss-security@...ts.openwall.com, Donald Buczek <buczek@...gen.mpg.de>, Solar Designer <solar@...nwall.com> Cc: Vegard Nossum <vegard.nossum@...cle.com>, Jiri Kosina <jkosina@...e.cz> Subject: Re: Re: Re: [MAINTAINERS SUMMIT] Handling of embargoed security issues -- security@...g vs. linux-distros@ On 8/25/23 04:17, Donald Buczek wrote: > We heavily rely on the information about kernel security issues published to linux-distros, which we, of course, can only receive via oss-security after the embargo. We analyze each and every new topic on oss-security to decide, whether it is relevant to us and what we can do about it. Nearly all of the userspace issues are of no relevance to us, but many of the kernel issues are, if we happen to run affected kernel versions. So you rely on oss-security, but not linux-distros. While every issue that goes to one of the distros lists must later appear on oss-security, there is no requirement that everything that comes to oss-security must first appear on the distros lists, and much of it does not. One possible outcome could be that issues are only sent to oss-security once public and not to linux-distros during an embargo period - that would still satisfy your needs, but make a lot of other folks unhappy. -- -Alan Coopersmith- alan.coopersmith@...cle.com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.