oss-sec mailing list archives
Re: Closed list
From: Dan Rosenberg <dan.j.rosenberg () gmail com>
Date: Fri, 1 Apr 2011 20:08:36 -0400
Hi Josh,
Long term I'd like to see two lists, one for purpose #1, and another geared toward #2. I think having a trusted venue for knowledge sharing would be very useful, and we likely don't want the list clogged with coordination details. This will of course rely heavily on what Openwall is willing to take on. They're already taking on a lot of risk and responsibility, I don't want to spoil the good will.
I agree that having such a venue for discussion would be valuable, and I'd personally like to contribute to such a list.
Should we require members use a mail address from their vendor? Letting people use personal addresses creates an opportunity for people to remain on a list when they are no longer a part of a given vendor (it also makes it quite easy to know who represents a vendor).
Yes, I think this should be a requirement for a closed coordination list (as opposed to the more relaxed option #2). In fact, I think membership to such a list should be restricted almost exclusively to distributions and downstream providers of third-party software. It obviously makes sense to have distro security teams on a list, since a vulnerability in project XYZ will need to be coordinated among all of the distros. However, most software projects only need access to information concerning their own project. There's no reason one software project should gain access to vulnerability information about a completely unrelated project, and restricting membership to achieve that will at least help minimize the leakage that went on with the previous list. In a nutshell, I think this list needs to decide what its purpose is. If it's for coordination for vulnerability disclosure, then its membership should be kept to those who actually need to do the coordination. If it's for private (or semi-private) discussion of potentially sensitive research, knowledge sharing, etc., then its membership should be expanded to include representation from software vendors and researchers. -Dan
Thanks. -- JB
Current thread:
- Re: Closed list, (continued)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Patrick J. Volkerding (Apr 01)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Patrick J. Volkerding (Apr 03)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Marc Deslauriers (Apr 01)
- Re: Closed list Charles Blas (Apr 01)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Charles Blas (Apr 01)
- Re: Closed list Dan Rosenberg (Apr 01)
- Re: Closed list Josh Bressers (Apr 01)
- Re: Closed list Dan Rosenberg (Apr 01)
- Re: Closed list Mike O'Connor (Apr 02)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Yves-Alexis Perez (Apr 04)
- Re: Closed list Solar Designer (Apr 04)
- Re: Closed list Josh Bressers (Apr 01)
- Re: Closed list Matthias Andree (Apr 05)
- Re: Closed list Tim Zingelman (Apr 05)
- Re: Closed list Solar Designer (Apr 05)