[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <874lrr3lbn.fsf@gnu.org>
Date: Sun, 24 Sep 2017 22:15:08 +0200
From: ludo@....org (Ludovic Courtès)
To: Hanno Böck <hanno@...eck.de>
Cc: oss-security@...ts.openwall.com
Subject: Re: Why send bugs embargoed to distros?
Hi,
Hanno Böck <hanno@...eck.de> skribis:
> I had informed the distros mailing list one week earlier about the
> upcoming disclosure with a bug description and links to the already
> available patch.
> My understanding is that the purpose of the distros list is that
> updates can be prepared so after a disclosure the time between "vuln is
> known" and "patch is available" is short.
> However from all I can see this largely didn't happen.
FWIW, for GNU Guix (which doesn’t have anyone yet on the distros list),
we pushed the patch less than 30 minutes after the public disclosure on
oss-sec¹.
The fact that your message to oss-sec was very clear on the issue and
its consequences, and contained a link to the (small) patch surely made
it easier to prepare the fix.
Ludo’.
¹ https://git.savannah.gnu.org/cgit/guix.git/commit/?id=e14ab0ad070b4eafa19fc1df81b7b5c3de1dc1b2
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
