[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170927150918.GA3037@openwall.com>
Date: Wed, 27 Sep 2017 17:09:18 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel CVEs not mentioned on oss-security
On Mon, Sep 25, 2017 at 09:50:59PM +0000, Priedhorsky, Reid wrote:
> 1. Is oss-security's coverage of security issues in open-source software intended to be comprehensive?
As others have said, no. (I think that would be an unrealistic goal.
It could also result in so much traffic we'd have to think of splitting
the list e.g. into notifications vs. discussions, but arguably that
would be a good problem to have.)
However, I would like the coverage to increase. When e.g. Debian
sends out a security advisory, they shouldn't literally post it in here.
We had asked (in list content guidelines) for distro-specific advisories
not to be sent in here, for good reasons. However, if Debian and any
other distros doing similar have the resources, I'd appreciate it if
they bring in here info on vulnerabilities in Open Source software that
they're tracking / are about to patch / have already patched / have even
issued advisories on, but that haven't been mentioned in here before.
Many distros (and/or people from distros' security teams) have been
doing just that from time to time, but certainly not consistently.
Maybe my encouragement above will help improve this?
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
