[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 30 Jul 2013 01:19:14 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: security-officer@...eBSD.org
Subject: Re: FreeBSD Security Advisory FreeBSD-SA-13:07.bind
On Mon, Jul 29, 2013 at 10:45:50PM +0200, Tomas Hoger wrote:
> Are FreeBSD advisories now going to be posted to oss-security? They
> were not posted here before. The list charter strongly discourages
> posting of vendor security advisories:
>
> http://oss-security.openwall.org/wiki/mailing-lists/oss-security#list-content-guidelines
Tomas is referring to:
"Security advisories aimed at end-users only are not welcome (e.g.,
those from a distribution vendor announcing new pre-built packages).
There has to be desirable information for others in the Open Source
community (e.g., an upstream maintainer may announce a new version of
their software with security fixes to be picked up by distributors)."
This guideline exists largely to avoid content duplication (as far as
non-end-users are concerned), which we'd see here if multiple distro
vendors were announcing their updates in here (since many if not most of
those updates would be for packages based on shared upstream code, and
thus for upstream code vulnerabilities that have already been reported
in here separately).
Given the above, I think it makes some sense to allow/encourage distro
vendor advisories for their own distro-specific issues to be posted in
here. This may seem counter-intuitive at first, but note that there's
no content duplication problem with those, and the distro is acting as a
(potential) upstream when they're announcing their own
vulnerability/update (relevant to be picked up by other distros who may
have reused that component or have otherwise similar code, and relevant
to all of us as an opportunity to learn from and potentially avoid
making a similar mistake or whatever the cause of the vulnerability was).
Looking at two recent FreeBSD advisories, I think
FreeBSD-SA-13:08.nfsserver is desirable for oss-security.
FreeBSD-SA-13:07.bind is less so. Was the underlying BIND issue
mentioned in here, though? It should have been! If this was in fact
the first mention, then better to have it in this form than none at all.
Now, I realize that selective posting of a distro vendor's security
advisories to a mailing list could be confusing (an end-user could then
expect to see all advisories from the vendor, and would possibly not
subscribe to an appropriate channel as a result of such confusion).
So maybe for things like FreeBSD-SA-13:08.nfsserver non-end-user /
non-advisory postings will work better, even if they refer to the
end-user advisory for more info.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
