[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANTw=MP2R6Qac+xW1GGME8AHx6Qhaw35mwXcTyBjbSKMBtNLSg@mail.gmail.com>
Date: Fri, 3 Feb 2012 20:26:26 -0500
From: Michael Gilbert <michael.s.gilbert@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: distros & linux-distros embargo period and message format
On Wed, Feb 1, 2012 at 11:54 PM, Solar Designer wrote:
> Yet I needed to bring the topic up. I was not 100% sure that some
> vendors currently on the list would find 7-11 days unacceptable. Being
> 90% sure was not enough.
>
> I've noticed a decrease in embargo periods over time - I think for
> vendor-sec the average might have been 14 days if not more, whereas now
> it might be down to 10-12 days or so (excluding the hash DoS thing).
> So we turned the old average into the new maximum. I thought that maybe
> we were ready for the "next level" - but it seems not. Maybe later?
I think the important aspect here is the transparency of the private
discussion (after an appropriate delay), rather than the length of the
delay itself. That can be set by the researcher (with some reasonable
maximum, like a month).
We all should be able to see what is going on over in the closed list.
Although it is unlikely being used for nefarious purposes (hiding
issues permanently, etc.), transparency (after a delay) is the only
way to show that it is not. Anyway, 30 days seems appropriate.
Best wishes,
Mike
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
