[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <BANLkTikdSO8W-zu6OTPeYwCOzR32bBYkLw@mail.gmail.com>
Date: Tue, 5 Apr 2011 09:46:25 -0500
From: Tim Zingelman <tez@...bsd.org>
To: oss-security@...ts.openwall.com
Subject: Re: Closed list
On Mon, Apr 4, 2011 at 10:02 AM, Matthias Andree <matthias.andree@....de> wrote:
> Am 02.04.2011 02:08, schrieb Dan Rosenberg:
>
> This raises an interesting point, "downstream providers of third-party
> software".
>
> In my case, I'd understand that I might want to offer vendors the
> possibility to co-ordinate upgrades for bogofilter, fetchmail, and
> leafnode, in lexicographical order, and possibly for a FreeBSD port --
> although I'm not a representative of FreeBSD's security officer team
> (nor would that team usually deal with third-party software
> vulnerabilities unless it's in the basde system).
Both FreeBSD and NetBSD have separate security teams that work to keep
the third-party software provided by the FreeBSD ports system
http://www.freebsd.org/ports/index.html and NetBSD pkgsrc system
http://www.netbsd.org/docs/software/packages.html patched for
vulnerabilities. (Note that the pkgsrc system is cross platform and
works on *BSD, Solaris, Linux and many other platforms.) I'd guess
other BSD and Solaris distro's have similar teams. I'd like to either
see members of these teams included, or a second list created for all
issues not specific to linux. (FWIW I am on the pkgsrc security
team.)
I'll also second the question someone else posed about how cc'ing
others off the list could reasonably work if all messages are
encrypted.
Thanks,
- Tim
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
