Re: Closed list

[akuster <akuster () mvista com>]

On 04/13/2011 01:02 PM, Mike O'Connor wrote:
> :----- Original Message -----

> For linux-distros, I think what you really want to go for here are
> *timely* updates.  If a distro isn't generally capable of producing a
> security update within, say, a month of when the issue was released,
> then their getting the issue in advance through linux-distros isn't
> going to do them or their distro community a lot of good because they
> have other constraints in getting fixes out the door. 
> Focusing on how
> you think an update ought to *look* (e.g. should the advisories be
> public?) isn't as important as the update getting *out*.  Especially
> since you're dealing with GPL'ed code, I think that's something you
> can measure.  Just ask the constituency a month or so after some major
> kernel issue who has released updates/fixes and who hasn't, show the
> relevant source, and take it from there.

Where would one draw the line? If one is truly worried about security
the units running the software need to validated (no suggesting this at
all, completely impractical).  Anyone up for going to Iraq to check our
customer's units? How about Bob's house, Jill's car or outer-space?

- Armin