[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110316100911.GD26611@core.inversepath.com>
Date: Wed, 16 Mar 2011 11:09:11 +0100
From: Andrea Barisani <lcars@...rt.org>
To: oss-security@...ts.openwall.com
Subject: Re: Vendor-sec hosting and future of closed lists
On Mon, Mar 14, 2011 at 11:28:14PM -0400, Mike O'Connor wrote:
> [catching up on old email]
>
> :> > As suggested by Josh Bressers oCERT would be favourable to providing a
> :> > system that would accept user submission and allow selection of security
> :> > contacts from our existing member database as well as other verified
> :> > contacts.
>
> ...
>
> :It all depends on how this process is going to be handled. I can see oCERT
> :helping in routing reports to the proper contacts via email to our trusted
> :member contacts as well as external ones that we can seek on a report basis.
>
> What I've observed is that some times, the reporter or coordinator
> doesn't have a good idea of the scope of their issue. To cite some
> real-world examples involving folks who I thought would know better:
>
> 1) no, BSD networking isn't just in Free/Net/OpenBSD
> 2) no, ONC RPC just isn't in Sun products
> 3) no, a RH-specific kernel issue is a general Linux kernel issue
>
> Scoping issues isn't always easy. How do you know whether I backported
> some bleeding-edge fix with broken security implications into one of the
> OSes I care about last week? Sometimes, I'll need specific info just to
> confirm that I don't care about the issue. Scoping is one of the things
> that vendor-sec was occasionally quite helpful with.
>
Putting reports within the proper context and hunting down all occurrences of
affected code in other projects has been one of oCERT goals from the
beginning.
I agree 100% that reporters often do not have this knowledge or do not care
about making the effort in scoping things in depth, that's exactly why oCERT
was created.
> --
> Michael J. O'Connor mjo@...o.mi.org
> =--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--==--=
> "I'd be terrific! Colossal! Stupendous! Mediocre even!" -Babs Bunny
--
Andrea Barisani | Founder & Project Coordinator
oCERT | Open Source Computer Emergency Response Team
<lcars@...rt.org> http://www.ocert.org
0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
"Pluralitas non est ponenda sine necessitate"
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
