[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20140709090652.GW1821@symphytum.spacehopper.org>
Date: Wed, 9 Jul 2014 10:06:52 +0100
From: Stuart Henderson <stu@...cehopper.org>
To: oss-security@...ts.openwall.com
Subject: Re: FreeBSD Security Advisory FreeBSD-SA-14:13.pam
On 2014/07/09 08:14, Sven Kieske wrote:
> Am 04.06.2014 07:42, schrieb Solar Designer:
> > I mention this so that people are not confused why this one advisory is
> > posted in here, even though we had decided that vendor-specific
> > advisories are normally not to be posted to oss-security.
>
> I'm sorry, but I'm still relatively new to this list, so forgive
> me my questioning:
>
> I see lots of "vendor specific" advisories here. So my guess
> is that "vendor" means "a vendor who bundles software into
> a linux/bsd/whatever distribution"?
This policy is presumably trying to stop the problem where lists receive
notification from 20 OS distributions that they have updated some common
package like PHP.
Personally I'm happy to see vendor-specific advisories for some problems
that just affect that vendor (but not the advisories for other problems
common to many vendors), but think that it needs to be a manual selective
process rather than just as another place where the advisories are CC'd.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
