oss-sec mailing list archives
Re: Closed list
From: Josh Bressers <bressers () redhat com>
Date: Tue, 5 Apr 2011 08:43:29 -0400 (EDT)
----- Original Message -----
On Tue, Apr 05, 2011 at 07:19:08AM -0400, Josh Bressers wrote:Not adding Apple to any coordination list would be plain silly. They were far more active than most of the distributions.Yes. But why do they need to be aware, say, of glibc vulnerabilities (ones that are in fact believed to be glibc-specific)?
This is an excellent point. It's a hard problem to solve honestly. I guess the question really comes down to this. Do the disadvantages of one list outweigh the benefits? I'm not sure what the answer is. There probably isn't an "answer" though, just lots of opinions.
I'm starting to worry we've created rules for the sake of rules, which almost never has a net positive outcome.What do you propose? Go back to a vendor-sec style list, open to anyone who is approved by other list members, and accept the accusations of being subjective in who we subscribe? I can set one up alongside the Linux distros list... then let the senders decide which list they want.
I don't have a proposal right now, which is why I'm glad we're having this discussion. I guess at the end of the day it comes down to the projects and reporters. Thinking in this regard, I think there could be advantages to having multiple lists with people subscribed to the various groups they belong, then the projects and researchers decide how they want their information distributed. This is why I like the idea of the membership list being public, it's makes it quite clear who would be receiving the information in question. We're really talking about a group that's a service to reporters, not the distributions or vendors. We want to make it easy for researchers and projects who approve of embargoes to work with us, and allow us to work with them in return. Thanks. -- JB
Current thread:
- Vouching system (was Re: [oss-security] Closed list), (continued)
- Vouching system (was Re: [oss-security] Closed list) Eugene Teo (Apr 05)
- Re: Vouching system (was Re: [oss-security] Closed list) Solar Designer (Apr 05)
- Re: Closed list Solar Designer (Apr 04)
- Re: Closed list Jeffrey Czerniak (Apr 04)
- Re: Closed list klondike (Apr 04)
- Re: Closed list Solar Designer (Apr 04)
- Re: Closed list Solar Designer (Apr 04)
- Re: Closed list Jeffrey Czerniak (Apr 04)
- Re: Closed list Josh Bressers (Apr 05)
- Re: Closed list Solar Designer (Apr 05)
- Re: Closed list Josh Bressers (Apr 05)
- Re: Closed list Vincent Danen (Apr 05)
- Re: Closed list Andrea Barisani (Apr 05)
- Re: Closed list Vincent Danen (Apr 05)
- Re: Closed list Solar Designer (Apr 05)
- Re: Closed list Vincent Danen (Apr 05)
- Re: Closed list Jeremy Stanley (Apr 06)
- Re: Closed list klondike (Apr 04)
- Re: Closed list Mike O'Connor (Apr 05)
- Re: Closed list Drew Yao (Apr 20)
- Re: Closed list Solar Designer (Apr 24)
- Re: Closed list Solar Designer (Apr 24)