oss-security - Re: Closed list

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110601163410.GA15759@openwall.com>
Date: Wed, 1 Jun 2011 20:34:10 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Closed list

Hi Armin,

On Thu, May 26, 2011 at 05:42:00AM -1000, akuster wrote:
> You can find our security Advisories at:
> http://www.mvista.com/cve_vulnerabilities.php
> 
> I have updated
> http://oss-security.openwall.org/wiki/vendors
> http://oss-security.openwall.org/wiki/distro-patches

Thanks.  I've just reviewed the above and subscribed you to the list.

I have some "complaints", though:

http://www.mvista.com/cve_vulnerabilities.php gives a mapping of CVE IDs
to affected MontaVista products.  That's great.  However, fix
information is missing.  Does having a CVE ID listed there imply that
you have fixed the issue for those affected products or not (e.g.,
perhaps not for EOL'ed products, or are you not listing those as
affected at all)?  Specifically relevant to this discussion would be the
dates on which you're getting issues fixed (such that those could be
compared to CRDs to see if you likely made use of the advance
notifications or not).  Right now, you have "Published" and "Modified"
dates, but no fix dates (which would be per product?)

Also, no info on 2011's CVEs yet.  Does this mean we'd have to wait
until 2012 to get an idea on how you're handling 2011's security issues?

That said, you do look like a security-conscious Linux distro vendor
now (and you meet some other requirements), so you're on the list.

Thanks again,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.