oss-security - Re: Vendor-sec hosting and future of closed lists

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110305223002.GC30397@kroah.com>
Date: Sat, 5 Mar 2011 14:30:02 -0800
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: Vendor-sec hosting and future of closed lists

On Sat, Mar 05, 2011 at 09:17:51PM +0100, S.P.Zeidler wrote:
> Hi,
> 
> Thus wrote Solar Designer (solar@...nwall.com):
> 
> > > - If yes, would it be an idea to confine or split into lists of focus groups?
> > >   (like Linux vendors, BSD vendors, all OSS source using vendors, etc?)
> > 
> > My current proposal is: split into several sub-lists.  I'd start with
> > three: Linux vendors, *BSD vendors, security "researchers".  The vendor
> > groups would be for externally submitted reports (by non-members) and
> > for cross-vendor discussions.
> 
> I'd suggest four, then: Linux (kernel and libc), BSD (kernel and other
> items shared between BSDs, but not commonly seen in Linux distributions),
> shared/userland (who eg doesn't have OpenSSL?), and researchers
> (no opinion on the latter).

This means that for a "normal" Linux distribution, someone would have to
be subscribed to at least 2 lists, and possibly three?

And where would someone post a problem to?  How would they know if a
pacakge is shared from BSD and Linux without having to do a lot of
research first?

I really don't mind seeing all of the traffic for all of the issues, but
perhaps the BSD developers get tired of seeing all of the Linux kernel
issues go across their mailbox so they don't want to have to see them
anymore :)

Either way, I think we still need a vendor-sec-like list for the
Linux distros, as it is very invaluable and provides a way to coordinate
things that is needed at times.

thanks,

greg k-h

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.