[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20110502184046.GA20492@openwall.com>
Date: Mon, 2 May 2011 22:40:46 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Closed list
On Mon, May 02, 2011 at 02:09:08PM -0400, Josh Bressers wrote:
> I think this is suitable. The goal here is to ensure that a vendor is
> actually producing updates and aren't just a potential leak.
OK, so do you propose that we subscribe Wind River, and wait for
MontaVista to setup something similar to these RSS feeds before we also
subscribe them?
A secondary goal behind requiring access to advisories and updates (not
just metainfo) would be to be able to draw the line between vendors and
companies that build their own Linux distros in house. The latter could
also publish an RSS feed showing how they update their packages, yet
they would not be a vendor to anyone other than themselves... On the
other hand, publishing updates without publishing the distro itself
doesn't make them more of a vendor to others. So to achieve this goal
we'd probably need to require the distro itself to be public (in at
least one form - e.g., Red Hat's .src.rpm's are sufficient), not just
advisories and updates.
We may choose not to pursue this secondary goal now.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
