Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Sep 2017 12:40:06 +0000
From: Ben Seri <>
To: Solar Designer <>
Subject: Re: Linux BlueBorne vulnerabilities

I agree. And I wish all vendors had such short time frames for releasing
Unfortunately this is not the case.

On top of this, it was unclear to us whether the linux-distros mailing list
would be able to coordinate the kernel patch, so we chose to contact both
lists, which required the 7 day embargo period.

In any case, we respect the need for a short embargo period, and in this
case we disclosed the issues 7 days prior to publication.


On Fri, Sep 15, 2017 at 3:31 PM Solar Designer <> wrote:

> On Fri, Sep 15, 2017 at 12:28:11PM +0000, Ben Seri wrote:
> > Our thought is that since these issues affect multi vendors that are
> using
> > Linux, the longer the embargo period, the better chance there is a
> > coordinated patch goes out to as many users as possible once the embargo
> is
> > lifted.
> Indeed, but it's 2017, not 1997.  14 days is considered a long embargo
> period now.  Unnecessarily long embargoes hurt more than they help.
> Alexander

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.