Re: Request for linux-distros list membership

[Solar Designer <solar () openwall com>]

On Sun, Apr 21, 2013 at 10:42:26AM +1000, Allan McRae wrote:
> On 21/04/13 06:29, Solar Designer wrote:
> > How do you expect to use the information arriving via linux-distros?
>
> I am intending to form a more official security response in Arch Linux
> rather than the quite adhoc process we have at the moment.  The
> information on linux-distros will be used to prepare updates to be
> released at the end of relevant embargo.

OK, I've just subscribed you.

I think it wouldn't have been unreasonable for the oss-security
community to expect you "to form a more official security response"
before joining linux-distros, so now you're sort of in debt. ;-)

Specifically, there doesn't appear to be an announcement channel for
Arch Linux security updates, nor even an issue tracker or change log
with security issues and fixes clearly marked as such.  You've listed a
bug tracker URL at:

http://oss-security.openwall.org/wiki/vendors#arch-linux

which is:

https://bugs.archlinux.org

Going to that URL, I see a list of all sorts of bugs.  Searching it for
"security", I find only 2 bugs.  Perhaps there were many more security
issues that you've actually dealt with, and you need to start
documenting them as such for your users.

Alexander