[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20231226003555.GA19071@openwall.com>
Date: Tue, 26 Dec 2023 01:35:55 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: linux-distros membership application of openEuler
On Tue, Dec 26, 2023 at 12:38:36AM +0100, Steffen Nurpmeso wrote:
> Hello. Please allow me a little opinion.
Please keep your postings more focused on the thread's topic.
> I want to point out that Huawei employees play an important role
> in creating solutions in the (public and open to anyone) IETF.
> Also financially.
> I personally think it is a friendly move to give back and support
> creating the infrastructure that we all build upon.
Fair enough.
> Which can easily be compared to many non-China companies and their
> attitude of take but no give.
To me, that's not an easy comparison at all. Most large companies or
their employees do give something these days, and without actual metrics
I cannot tell if e.g. Huawei or Microsoft contributes more.
> |However, that might not be enough to prevent people from being concerned
> |and discouraged from participating if openEuler joins. This is why I
> |suggested that it's best if openEuler does not join now, and that people
> |who had commented before could want to say whether their concerns are
> |now sufficiently addressed or maybe not.
>
> Me personally no, but for one i am noone regarding vivid members
> of this list, and second i have no political pressure against me.
OK.
> and i really today stumbled over his funny opinion
>
> . All "early notice" lists are leaks and should be considered
> public.
> . Unless your project is not used by anyone.
> . Otherwise, why would your government allow it to exist?
I think Greg's stance on this is inconsistent, if we also recall his
preference against full public disclosure of issues discussed on private
lists and his running of private lists on CPU microarchitectural issues.
However, the concern about leaks is valid. I think the most effective
defense we have is the 14 days maximum embargo time, which removes the
data's long-term value for potential use in attacks.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
