[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170706210741.GA9171@openwall.com>
Date: Thu, 6 Jul 2017 23:07:41 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: accepting new members to (linux-)distros lists
On Thu, Jul 06, 2017 at 10:09:08PM +0200, Kristian Fiskerstrand wrote:
> On 06/30/2017 03:22 PM, Solar Designer wrote:
> > This is now up to 22 items: I've split one in two, and added three more.
> > The full list is at:
> >
> > http://oss-security.openwall.org/wiki/mailing-lists/distros#contributing-back
> >
> > No volunteers so far? I know some of you are actually helping with
> > these, but I'd prefer that you explicitly take responsibility for them.
>
> Gentoo is offering to take all, or a subset of, [9, 11 - 13] as primary
> distribution:
> 9. Stay on top of issues to ensure progress is being made, remind others
> when there's no apparent progress, as well as when the public disclosure
> date for an issue is approaching and when it's finally reached (unless
> the reporter beats you to it by making their mandatory posting to
> oss-security first)
>
> 11. Make sure the mandatory oss-security posting is made promptly and is
> sufficiently detailed, and remind the reporter if not
>
> 12. If exploit(s) were shared on the list, make sure that either they're
> included in the oss-security posting along with the issue detail or the
> posting includes an announcement of planned later posting of the
> exploits (with the delay being within list policy), and in the latter
> case also make sure that the later posting is in fact made as planned,
> and remind the reporter if not
>
> 13. Keep track of per-report and per-issue handling and disclosure
> timelines (at least times of notification of the private list and of
> actual public disclosure), at regular intervals produce and share
> statistics (most notably, the average embargo duration) as well as the
> raw data (except on issues that are still under embargo) by posting to
> oss-security
OK, accepted. Thank you very much!
So far CloudLinux and Gentoo volunteered for specific tasks. I'll mark
this on the wiki shortly.
Other distros are yet to volunteer (please do!)
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
