[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130618165347.GS21784@sentinelchicken.org>
Date: Tue, 18 Jun 2013 09:53:47 -0700
From: Tim <tim-security@...tinelchicken.org>
To: oss-security@...ts.openwall.com, kseifried@...hat.com
Subject: Re: Thoughts on a vuln/CVE?
> However my original question still stands, can/should we consider a
> common configuration of software that goes from being secure to
> insecure to be worthy of a CVE? A lot of things that used to be common
> practice (like shipping every service/server enabled, all accounts
> active, all access enabled, anonymous uploads allowed, etc.) are now
> seen as security vulnerabilities/exposures.
To me, it's a big grey area as far as assigning a CVE for stuff like
this.
But there's no reason we shouldn't raise awareness through venues like
the various CERTs. Though it seems US-CERT is only really good at
re-sending microsoft and apple advisories these days. =(
tim
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
