Re: CVE request: rufus

[Solar Designer <solar () openwall com>]

Stefan, Pete -

As a moderator for oss-security, I approved these messages for their
technical substance, but I don't appreciate the personal
(counter-)attacks.  Let's please refrain from discussing people's
experience, behavior, etc. and focus solely on the technical issues.

(Unfortunately, when I say this I do point out an issue with behavior,
but only as it relates to what I'd like not to see on this list.  I don't
judge what's appropriate or not in general; I only set the policy here.)

On Thu, May 31, 2018 at 08:04:52PM +0200, Stefan Kanthak wrote:
> READ THE SUBJECT!
> Hint: it reads "CVE request".

oss-security is no longer a place to make CVE requests.  Please see:

http://oss-security.openwall.org/wiki/mailing-lists/oss-security#cve-requests

"Previously, one could request CVE IDs for issues in Open Source
software from oss-security.  This is no longer the case.  Instead, please
start by posting about the (to be made) public issue to oss-security
(without a CVE ID), request a CVE ID from MITRE directly, and finally
"reply" to your own posting when you also have the CVE ID to add.  With
the described approach you would only approach MITRE after the issue is
already public, but if you choose to do things differently and contact
MITRE about an issue that is not yet public, then please do not disclose
to them more than the absolute minimum needed for them to assign a CVE ID."

When the occasional CVE request messages that still arrive in here are
otherwise on topic, like this time, we approve those anyway for their
content.  If a CVE ID is desired, the sender is then expected to follow
the above procedure.

Thanks,

Alexander