[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <56E0BE38.6030400@igalia.com>
Date: Thu, 10 Mar 2016 01:22:16 +0100
From: Carlos Alberto Lopez Perez <clopez@...lia.com>
To: oss-security@...ts.openwall.com
Subject: Re: RE: Concerns about CVE coverage shrinking - direct
impact to researchers/companies
On 06/03/16 19:46, Alan Coopersmith wrote:
> On 03/ 4/16 04:07 PM, Tim wrote:
>> * No moderation required. Let the public decide if they believe the
>> researcher or vendor. If a moderator does bother to look over the
>> content, they could deduplicate/link issues together and address any
>> confusion, but beyond that, it isn't their job to decide what is a
>> vulnerability and what isn't.
>
> If the site displays *any* user-submitted text, you need at least enough
> moderation to filter out spammers & trolls.
>
I don't think you need that level of moderation if you implement basic
measures against spammers like requiring the creation of an account with
e-mail verification.
Just look to all the public bugzillas out there that allow commenting
(mozilla, webkit, redhat, gnome, etc). I don't think they have a problem
with spam. But you have to create an account first to do any comment.
Of course any account used for spam is blocked by the moderators. So the
spammer has to create a new one, which is just not worth the effort.
Download attachment "signature.asc" of type "application/pgp-signature" (884 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
