oss-security - Re: non-Linux advance notification list

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111127231350.GA21202@openwall.com>
Date: Mon, 28 Nov 2011 03:13:50 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: non-Linux advance notification list

All -

On Mon, Nov 28, 2011 at 02:56:22AM +0400, Solar Designer wrote:
> OK, now this is starting to look about as ridiculous as the old "closed
> list" thread did. ;-)  I am approving these messages so far in part
> because I think they serve as (valid) criticism of the idea of such
> lists, even if the senders did not intend such meaning.  I have mixed
> feelings about these advance notification lists myself.

Oh, I think I need to clarify.  By "these messages" above, I mean closed
list membership requests that lack justification.  I can see how my
positive reply to Tim's message might have created the false impression
that no justification was required.  In fact, NetBSD/pkgsrc had previously
expressed interest in being on such a list (during the "closed list"
thread from half a year ago), Tim posted from his @pkgsrc address, and I
verified that he was credited for pkgsrc security work just recently:

http://mail-index.netbsd.org/current-users/2011/10/03/msg017924.html

"pkgsrc security: OBATA Akio, Guillaume Lasmayous, Fredrik Pettai, Tim
Zingelman"

None of these things were true for Joost's and Michael's requests - so I
had no better choice than to ask them for justification.

It'd help avoid any confusion like that if further requests include
justification in a more explicit form, even when the sender can
reasonably expect that I'd recognize their OS and themselves and their
involvement in security work for their OS.  While I did recall past
discussions and notice the @pkgsrc address, not everyone did, which
clearly caused confusion.

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.