Re: Closed list

[akuster <akuster () mvista com>]

Dan,

I personally want a public list but its more of an internal Company
philosophy / process issue and more importantly what our customers
think. There could even be contractual issues involved.

If one would look at our customer list, I think one could indirectly
determine that we would have to provide security fixes (
http://mvista.com/customers.php ).

How do I meet the requirement of "Proof"?

- Armin


On 04/13/2011 06:19 AM, Dan Rosenberg wrote:
> Hi Armin,
>
> > What method of proving this would be acceptable? screen shot, temporary
> > access to our site, public list or other?
>
> I'm confused why you think posting an advisory publicly would somehow
> put your customers in any sort of additional danger.  All of the
> vulnerabilities you would be fixing are certain to have public
> advisories for other distributions, so it seems obvious that your
> customers would be affected also.  It's not as though your advisories
> are the only indication to an attacker that your customers are
> vulnerable.
>
> Regards,
> Dan