[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <cig332v9bacnlt.fsf@u54e1add816995a33037d.ant.amazon.com>
Date: Tue, 2 Feb 2021 10:48:30 -0800
From: Anthony Liguori <aliguori@...n.com>
To: Solar Designer <solar@...nwall.com>, <oss-security@...ts.openwall.com>
Subject: Re: Gentoo's "contributing back" linux-distros tasks
Anthony Liguori <aliguori@...n.com> writes:
> Solar Designer <solar@...nwall.com> writes:
>
>> 13. Keep track of per-report and per-issue handling and disclosure
>> timelines (at least times of notification of the private list and of
>> actual public disclosure), at regular intervals produce and share
>> statistics (most notably, the average embargo duration) as well as the
>> raw data (except on issues that are still under embargo) by posting to
>> oss-security - primary: Gentoo, backup: Amazon
>>
>> and we saw some contributions from Gentoo on these, most notable being
>> their work on the statistics (task 13 above):
>>
>> https://oss-security.openwall.org/wiki/mailing-lists/distros/stats
>>
>> Unfortunately, the last update of these statistics ("Last modified:
>> 2019/10/15 01:52 by kristianf") is also when the contributions ceased.
>>
As part of planning on getting this going again, I want to just review
the cadence and update duration.
I think this is easiest to do on the 15th of every month for the
previous month. As example, on 2/15, we would post the statistics for
February. Since the maximum embargo duration is 2-weeks, this would not
disclose any embargoed information.
Does this seem reasonable?
Regards,
Anthony Liguori
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
