[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTimSfNQvob8xSkFtnHZ7reykFdefj=UMJ7vv+iVN@mail.gmail.com>
Date: Fri, 1 Apr 2011 16:17:32 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Cc: Josh Bressers <bressers@...hat.com>
Subject: Re: Closed list
Hi,
>
> Here is the plan for initial membership (this is also approved by
> Openwall).
>
> Initial members will have had to be a vendor-sec member (no exploders this
> time around). You must reply to this thread, in public (on oss-security).
> We want this to be very public, we have nothing to hide. You must have a
> public gpg key ID included in your reply. The new list will gpg encrypt all
> mail (it does accept plaintext messages though).
>
I'd prefer if any private replacement for vendor-sec were either:
1. Strictly limited to vendor coordination of embargoed security
issues (with membership reflecting this purpose), or
2. Opened up to researchers who have contributed knowledge and
findings in this area, and are deemed trustworthy by other list
subscribers or some other community opinion.
In other words, it doesn't make sense to me to use "member of the old
vendor-sec" as the only requirement for subscription, as some of the
old members may not be eligible depending on the purpose of the new
list. I understand that this is just a preliminary solution, but I
think the question of membership should be sorted out sooner rather
than later.
Thanks,
Dan
> Once we have an initial seed group, we can focus on future membership
> ideas.
>
> Thanks.
>
> --
> JB
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
