announcing oss-security to Bugtraq & f-d

[Solar Designer <solar () openwall com>]

On Fri, Apr 04, 2008 at 03:35:53PM -0400, Josh Bressers wrote:
> My initial thought here is why?  I still see oss-security as a group in its
> inception.  I'm personally not entirely happy with the content on the wiki
> yet (it has far too many holes).  Sadly other things have been preventing
> me from working on it lately.

Indeed.  My thought was that maybe some of those Bugtraqers would
actually help us in working on the wiki content.  Of course, we may also
get inappropriate edits, which we'll have to deal with, but that's life.
Wikipedia is very well known and popular - yet they manage to keep the
wiki wide open and with reasonable content.

Also, many of our wiki pages are intended for a wider audience than the
current oss-security membership.  Keeping the intended audience unaware
of our wiki is counter-productive.

Finally, there's PageRank.  We can't make it easy to find our wiki
content when our wiki is not linked to from lots of sites.

> I'm also quite happy with the rather slow growth we're currently seeing on
> the mailing list.  We need a solid base before we can handle what will be
> explosive list growth from a big public announcement.

Understood and agreed.  I thought that we kind of already had a
sufficiently solid base for this, and I also noticed that we became
inactive at populating the wiki lately - which means that delaying the
announcement by another month might not result in us having much more
and/or better wiki content by then.

> > Also, Josh, are you OK with mentioning oCERT here? -
> >
> > http://oss-security.openwall.org/wiki/disclosure/researcher
>
> We really need a page dedicated to embargoed issue handling organizations.
> For now though, that would be appropriate given it already lists a few
> organizations.

Andrea - maybe you'd like to join us in populating the wiki with content -
e.g., you could start by adding a mention of oCERT to the above page,
then proceed to create a new page (also in the disclosure namespace?) on
CERT-like organizations (with more detailed information than that
already available on the links page).

Thanks,

Alexander