oss-security - Re: Adding Xen.org contact to linux-distros security list

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120203230721.GA18730@openwall.com>
Date: Sat, 4 Feb 2012 03:07:21 +0400
From: Solar Designer <solar@...nwall.com>
To: Ian Campbell <ijc@....org>
Cc: oss-security@...ts.openwall.com
Subject: Re: Adding Xen.org contact to linux-distros security list

On Fri, Feb 03, 2012 at 09:33:05AM +0000, Ian Campbell wrote:
> Would it be possible for myself to be subscribed to the linux-distros
> security list as a representative of Xen.org?

I think not.  We had a few exceptions like this on vendor-sec, but when
setting up the linux-distros list I proposed not to be making such
exceptions anymore and everyone seemed to agree.  In fact, that's even
reflected in the list name - on purpose.

Thanks for bringing the topic up anyway.  It helps to know what's in
demand and see what solutions we have (or don't have).

> Although Xen.org is not a distro we do incorporate upstream software and
> one of our upstreams (qemu) uses this list as their embargoed security
> announcement channel. We would like to be able to co-ordinate the
> release of fixes into our own qemu trees.

I think you should contact the QEMU folks and ask them to CC you on
relevant notifications.  I think they will start doing it if they don't
mind.  And if they do mind, then it'd be inappropriate to bypass that.

Meanwhile, I've edited this wiki page:

http://oss-security.openwall.org/wiki/mailing-lists/distros

to ask reporters to consider notifying not only distro vendors, but also
affected Open Source projects (if applicable).  Specifically:

"If the security issue you're reporting affects other systems as well
(from vendors not represented on these lists), please consider notifying
other affected distro vendors and/or Open Source projects as well and
mention what you're doing on this or what you'd like done on it in your
notification to the list."

where "distro vendors" and "Open Source projects" are links to:

http://oss-security.openwall.org/wiki/vendors
http://oss-security.openwall.org/wiki/software

You could want to add Xen.org contact information to the latter page.

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.