oss-security - Re: tool announcements

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Tue, 3 Jun 2008 18:08:59 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: tool announcements

On Tue, 3 Jun 2008, Pierre-Yves Rofes wrote:

> Looking at the archives, at least half of the topics are CVE requests,
> so maybe we should think about renaming the list "oss-CVEreq" :)

Until oss-security, these CVE requests were typically made either by one
distro and included in their bug report, or through vendor-sec even if the
issue was technically public.  When we assigned the CVE, it would often
become the first place where the issue was more widely announced.
Amongst the other benefits of this list, I think it provides a function
for wider, quicker dissemination of these types of issues.  The CVE
requests just happen to be part of the coordination function that the
distros used to perform in less visible ways.

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.