oss-security - Re: Closed list

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1427368006.383179.1302007409505.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Tue, 5 Apr 2011 08:43:29 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Closed list

----- Original Message -----
> On Tue, Apr 05, 2011 at 07:19:08AM -0400, Josh Bressers wrote:
> > Not adding Apple to any coordination list would be plain silly. They
> > were far more active than most of the distributions.
> 
> Yes. But why do they need to be aware, say, of glibc vulnerabilities
> (ones that are in fact believed to be glibc-specific)?

This is an excellent point. It's a hard problem to solve honestly. I guess
the question really comes down to this. Do the disadvantages of one list
outweigh the benefits? I'm not sure what the answer is. There probably
isn't an "answer" though, just lots of opinions.

> 
> > I'm starting to worry we've created rules for the sake of rules, which
> > almost never has a net positive outcome.
> 
> What do you propose? Go back to a vendor-sec style list, open to anyone
> who is approved by other list members, and accept the accusations of
> being subjective in who we subscribe? I can set one up alongside the
> Linux distros list... then let the senders decide which list they want.
> 

I don't have a proposal right now, which is why I'm glad we're having this
discussion.

I guess at the end of the day it comes down to the projects and reporters.
Thinking in this regard, I think there could be advantages to having
multiple lists with people subscribed to the various groups they belong,
then the projects and researchers decide how they want their information
distributed.

This is why I like the idea of the membership list being public, it's makes
it quite clear who would be receiving the information in question. We're
really talking about a group that's a service to reporters, not the
distributions or vendors. We want to make it easy for researchers and
projects who approve of embargoes to work with us, and allow us to work
with them in return.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.