oss-security - Re: help wanted - bring more issues in here

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240308205417.GA3048@openwall.com>
Date: Fri, 8 Mar 2024 21:54:17 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: help wanted - bring more issues in here

Hi,

So far, I only heard from Katherine Mcmillan (and suggested a first task
to her off-list).  Any other volunteers, please?

BTW, for quoting web page content, I use ELinks in a terminal window set
to width 80 (and arbitrary height), and use "Save formatted document"
from there.  Then in the resulting text file, review the list of links
at the end and remove duplicate and irrelevant ones.  (Some of this can
later be automated, if we do it a lot.)  The text file can then be
either included in the message body (but you need to clearly distinguish
it from your own writing) or attached (as text/plain, please).

On Thu, Mar 07, 2024 at 05:17:03PM -0800, Alan Coopersmith wrote:
> I also notice far more than I can send on myself, so tend to filter both
> for those projects that are more likely to be distributed directly by
> distros and more widely installed on systems, and for issues that seem
> to have a higher level of impact.  So I'm not sending on notice of every
> bug in every WordPress plugin, nor every npm module.
> 
> If people want to see different coverage here, speaking up can change that,
> but helping out as described above will make an even bigger impact.

I think we don't need a different coverage aka lower threshold (but yes,
speaking up can change that).  I think there are still many issues and
news above the current threshold that are not getting reported in here.

As to lower overall severity issues, such as those in some project's
obscure third-party plugins, I think it'd be good to have regular
digests on those, like it's already being done for Jenkins plugins, not
per-issue messages.  So if anyone keeps track of e.g. WordPress plugin
or npm module issues (Alan's examples above) and is willing to produce
digests, please feel free.

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.