[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190726110743.GA20519@openwall.com>
Date: Fri, 26 Jul 2019 13:07:44 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Statistics for distros lists updated for 2019Q2
On Fri, Jul 26, 2019 at 12:25:47PM +0200, Kristian Fiskerstrand wrote:
> On 26.07.2019 10:16, Solar Designer wrote:
> > Now you have updated stats, but you've dropped all of the detail. :-(
> > Please re-add it ASAP.
>
> Woops, had indeed overwritten wrong CSV file. Fixed :)
Thanks!
There's also Apache httpd CVE-2019-0211, which was first posted to
oss-security and then (wrongly) brought to distros. You list it with
negative embargo period of -0.24 days, which technically makes sense,
but it probably skews the averages, which are meant to be for actual
embargoes. Even if we set it to zero, it'd continue to skew the
averages. So we should probably consistently exclude non-positive
embargo periods from the calculation of averages. Will you, please?
This brings up and leaves open the question of what to do with very
short embargo periods like a few hours. My suggestion is that we
continue to include them in the averages, but also add calculation and
reporting of median embargo times (also excluding just the non-positive
embargo periods from the calculation of the medians). Can you do it,
please?
The non-positive embargo periods should probably continue to be listed
in the detail table, but a (foot)note should be added explaining that
they're excluded from the calculations.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
