[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20210202204420.GA28811@openwall.com>
Date: Tue, 2 Feb 2021 21:44:20 +0100
From: Solar Designer <solar@...nwall.com>
To: Anthony Liguori <aliguori@...n.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Gentoo's "contributing back" linux-distros tasks
On Tue, Feb 02, 2021 at 10:48:30AM -0800, Anthony Liguori wrote:
> Anthony Liguori <aliguori@...n.com> writes:
>
> > Solar Designer <solar@...nwall.com> writes:
> >
> >> 13. Keep track of per-report and per-issue handling and disclosure
> >> timelines (at least times of notification of the private list and of
> >> actual public disclosure), at regular intervals produce and share
> >> statistics (most notably, the average embargo duration) as well as the
> >> raw data (except on issues that are still under embargo) by posting to
> >> oss-security - primary: Gentoo, backup: Amazon
> >>
> >> and we saw some contributions from Gentoo on these, most notable being
> >> their work on the statistics (task 13 above):
> >>
> >> https://oss-security.openwall.org/wiki/mailing-lists/distros/stats
> >>
> >> Unfortunately, the last update of these statistics ("Last modified:
> >> 2019/10/15 01:52 by kristianf") is also when the contributions ceased.
>
> As part of planning on getting this going again, I want to just review
> the cadence and update duration.
>
> I think this is easiest to do on the 15th of every month for the
> previous month. As example, on 2/15, we would post the statistics for
> February. Since the maximum embargo duration is 2-weeks, this would not
> disclose any embargoed information.
>
> Does this seem reasonable?
You mean for January. Yes.
Occasionally there will be an issue that should have already been made
public but actually wasn't yet, or not on oss-security. An issue where
others responsible failed to ensure its timely and proper public
disclosure. In such cases, I expect the person working on the
statistics task would notice that and help ensure this issue is made
public without further delay and properly (such as by pinging others to
do it), and only then will post the statistics including the issue. In
fact, if the statistics task is correctly worked on, such issues with
issues are impossible not to notice: every issue in the published raw
data for the statistics should have its corresponding oss-security
posting referenced. So you'd notice when trying to fill in that field.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
