Re: FreeBSD Security Advisory FreeBSD-SA-14:13.pam

[Stuart Henderson <stu () spacehopper org>]

On 2014/07/09 08:14, Sven Kieske wrote:
> Am 04.06.2014 07:42, schrieb Solar Designer:
> > I mention this so that people are not confused why this one advisory is
> > posted in here, even though we had decided that vendor-specific
> > advisories are normally not to be posted to oss-security.
>
> I'm sorry, but I'm still relatively new to this list, so forgive
> me my questioning:
>
> I see lots of "vendor specific" advisories here. So my guess
> is that "vendor" means "a vendor who bundles software into
> a linux/bsd/whatever distribution"?

This policy is presumably trying to stop the problem where lists receive
notification from 20 OS distributions that they have updated some common
package like PHP.

Personally I'm happy to see vendor-specific advisories for some problems
that just affect that vendor (but not the advisories for other problems
common to many vendors), but think that it needs to be a manual selective
process rather than just as another place where the advisories are CC'd.