flaw disclosure (was: FAQ for upstream maintainers)

[Solar Designer <solar () openwall com>]

On Wed, Feb 20, 2008 at 08:37:31AM -0500, Josh Bressers wrote:
> I just created the namespace "disclosure" and added an outline I have to
> them.  I also added a note that the things in "whattodo" should be merged
> into the namespace.

I like the way you have approached this, and the initial content.  Now
we need to work on it more.

Also, while I like the Researcher vs. Project distinction, we need to
provide guidelines for the case when both a Researcher discloses a flaw
to a Project, and a Project discloses the flaw to distributors.  In this
case, which is quite typical, it may be the Project's responsibility to
communicate things such as embargo dates and credit "requirements" - or
the Project may get the Researcher in touch with the distributors (e.g.,
vendor-sec) directly.

> For the moment it's just my outlines, I've not gotten around to filling it
> out yet.  I did this, as I think it's important we have some amount of
> organized information up, as this:
> http://linsec.ca/blog/2008/02/17/new-informal-security-organization-oss-security/
>
> Was just picked up by linuxsecurity.com

Apparently, linuxsecurity.com is not that popular, and there was no
direct link to our wiki from the linuxsecurity.com news item (the only
link was via Vincent's blog).  So we only got around 50 unique visitors
per day for a while, and now we're down to 25 or so.  Many of the
visitors are actually exploring the wiki pages, though, so the number of
page hits is 450 to 3500 per day - but much of that traffic could be
from us, the list members.  BTW, there are around 70 subscribers on this
list now.

Obviously, I expect a lot more visitors to the wiki and quite some more
list members once we start to "advertise" this resource.

> We will only get one look from a lot of people, and if they don't see
> anything of value, they will likely never look again.

This is probably true, but we have yet to get that first look from most
people who might potentially be interested.

Thanks,

Alexander