[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 27 Aug 2023 10:23:45 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com, Donald Buczek <buczek@...gen.mpg.de>,
Solar Designer <solar@...nwall.com>
Cc: Vegard Nossum <vegard.nossum@...cle.com>, Jiri Kosina <jkosina@...e.cz>
Subject: Re: Re: Re: [MAINTAINERS SUMMIT] Handling of embargoed
security issues -- security@...g vs. linux-distros@
On 8/25/23 04:17, Donald Buczek wrote:
> We heavily rely on the information about kernel security issues published to linux-distros, which we, of course, can only receive via oss-security after the embargo. We analyze each and every new topic on oss-security to decide, whether it is relevant to us and what we can do about it. Nearly all of the userspace issues are of no relevance to us, but many of the kernel issues are, if we happen to run affected kernel versions.
So you rely on oss-security, but not linux-distros. While every issue that
goes to one of the distros lists must later appear on oss-security, there
is no requirement that everything that comes to oss-security must first
appear on the distros lists, and much of it does not.
One possible outcome could be that issues are only sent to oss-security
once public and not to linux-distros during an embargo period - that would
still satisfy your needs, but make a lot of other folks unhappy.
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
