Re: Closed list

[akuster <akuster () mvista com>]

Thomas,

Thanks for the feedback. That kind of list is what I had hoped MV could
have created a year ago. Resources shot it down then and now MV has
added a few more issues to work through.

If SUSE's http://support.novell.com/security/cve/ is an example of what
is being sot to meet the public advisory requirement, then I know what
MV needs to do.

Mahalo,
Armin

On 04/13/2011 10:38 PM, Tomas Hoger wrote:
> Hi Armin!
>
> On Wed, 13 Apr 2011 05:59:20 -1000 akuster wrote:
>
> > > It's clear that one of the membership requirements is now producing
> > > security updates. 
> >
> > What method of proving this would be acceptable? screen shot,
> > temporary access to our site, public list or other?
>
> A quick idea, rather than a real guidance:  Several vendors offer some
> sort of public CVE database that can be used to search for vendor's
> updates to address particular flaw.  If you're already tagging your
> updates with CVE ids, this may not be hard to provide.  Not because
> folks on this list ask you to do so, but because it's likely to provide
> a significant benefit to your customers with little extra cost/effort on
> top of what you already do.
>
> SUSE's database is probably closest to what may work for you as well.
> CVE info is split by a patched product+version, with links to
> customer-only download site for the enterprise products.
>
> http://support.novell.com/security/cve/