[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+aC4ktANtitip_dsvtwkuU6UEikdLzdH=prrhuXrcfL4LzQvA@mail.gmail.com>
Date: Fri, 20 Mar 2015 08:54:29 -0700
From: Anthony Liguori <anthony@...emonkey.ws>
To: oss-security@...ts.openwall.com
Subject: Re: membership request to the closed linux-distros
security mailing list
On Fri, Mar 20, 2015 at 8:50 AM, Stuart Henderson <stu@...cehopper.org> wrote:
> On 2015/03/20 08:16, Anthony Liguori wrote:
>>
>> I think the alternative is to formalize what already appears to be the
>> existing practice: disclose distros@ on the existence of a
>> vulnerability but require direct contact for the details of the
>> vulnerability if the submitter/upstream thinks the impact is high.
>
> Are private lists even needed if this policy is taken?
I think there's a lot of value in being able to just send a low-medium
impact issue to a single list of groups that have gone through some
level of vetting without needing to respond directly to individuals
and making value judgements.
I also think it's helpful to have a single point of contact so that an
upstream isn't dealing with 10 different people from a single
organization asking for details.
Regards,
Anthony Liguori
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
