[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4DA71FC8.5060101@mvista.com>
Date: Thu, 14 Apr 2011 06:24:40 -1000
From: akuster <akuster@...sta.com>
To: oss-security@...ts.openwall.com
CC: Mike O'Connor <mjo@...o.mi.org>
Subject: Re: Closed list
On 04/13/2011 01:02 PM, Mike O'Connor wrote:
> :----- Original Message -----
> For linux-distros, I think what you really want to go for here are
> *timely* updates. If a distro isn't generally capable of producing a
> security update within, say, a month of when the issue was released,
> then their getting the issue in advance through linux-distros isn't
> going to do them or their distro community a lot of good because they
> have other constraints in getting fixes out the door.
> Focusing on how
> you think an update ought to *look* (e.g. should the advisories be
> public?) isn't as important as the update getting *out*. Especially
> since you're dealing with GPL'ed code, I think that's something you
> can measure. Just ask the constituency a month or so after some major
> kernel issue who has released updates/fixes and who hasn't, show the
> relevant source, and take it from there.
Where would one draw the line? If one is truly worried about security
the units running the software need to validated (no suggesting this at
all, completely impractical). Anyone up for going to Iraq to check our
customer's units? How about Bob's house, Jill's car or outer-space?
- Armin
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
