oss-sec mailing list archives
Re: Closed list
From: Solar Designer <solar () openwall com>
Date: Mon, 4 Apr 2011 02:57:54 +0400
On Fri, Apr 01, 2011 at 10:13:05PM -0400, Mike O'Connor wrote:
I use my personal address rather than my work address for handling vendor security matters because:
Thank you for explaining this in here.
The vetting should be about more than email domains. There should be periodic maintenance of who's on the list to cull out those who aren't involved. Marcus did that to some degree with the vendor-sec of old.
Right.
I think the biggest problems there were the exploders and the lack of encryption,
Maybe (re: "biggest").
and both of those are being addressed with this new list as I understand things.
Yes, they are.
I think that having a couple lists, one for "tactical" issues (e.g. embargoes and CVE assignment) and another for "strategic" discussions (e.g. "how to deal with vagaries in gcc vs. C standards with general security impact") may be appropriate. I'm part of another security community which has such a notion, and it seems to help in keeping things focused, FWIW.
It appears that this is what we will have, but I am starting with one list that is more obviously needed (alternative to CC lists). Your specific example re: "how to deal with vagaries in gcc vs. C standards with general security impact" would be best discussed on oss-security (that is, on a public list), though. It does not benefit from a short embargo, and long embargoes are inappropriate. Alexander
Current thread:
- Re: Closed list, (continued)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Patrick J. Volkerding (Apr 03)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Marc Deslauriers (Apr 01)
- Re: Closed list Charles Blas (Apr 01)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Charles Blas (Apr 01)
- Re: Closed list Dan Rosenberg (Apr 01)
- Re: Closed list Josh Bressers (Apr 01)
- Re: Closed list Dan Rosenberg (Apr 01)
- Re: Closed list Mike O'Connor (Apr 02)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Solar Designer (Apr 03)
- Re: Closed list Yves-Alexis Perez (Apr 04)
- Re: Closed list Solar Designer (Apr 04)
- Re: Closed list Josh Bressers (Apr 01)
- Re: Closed list Matthias Andree (Apr 05)
- Re: Closed list Tim Zingelman (Apr 05)
- Re: Closed list Solar Designer (Apr 05)
- Re: Closed list Solar Designer (Apr 03)