Re: Closed list

[Oracle Security Alerts <secalert_us () oracle com>]

On 04/30/11 08:26 AM, Solar Designer wrote:
> Does Oracle start to prepare security updates for Oracle Enterprise
> Linux before or after Red Hat releases theirs?  If it's after, then
> there's too little need for Oracle to have advance notification.

If we know about vulnerabilities in advance, our fixing process
starts before Red Hat releases their updates. It starts with
assessment of issue, reviewing the fix for completeness and
applicability to our kernel and components we maintain or provide in
our Linux distribution. See
http://www.oracle.com/us/technologies/linux/026042.htm
or http://oss.oracle.com/

We do not expect Red Hat or other vendors to evaluate impact of
security vulnerabilities on Oracle Linux, nor fix it in a way that
is applicable to our releases. Hence the request for subscription.

We have a large user base to protect. We do get reports of
vulnerabilities in our Linux distribution which we may want to fix
in collaboration with rest of the community.

> Oracle was never actually accepted to vendor-sec for Oracle Enterprise Linux.

Not correct. From archives of vendor-sec I see there had been at
least two representatives from Oracle Linux at vendor-sec and we had
membership ever since Oracle started distributing Linux.

This discussion was held whenever they requested to subscribe to
vendor-sec and it was concluded that while we may be redistributing
some packages, Oracle Linux is a distro in its own right.

> Then, the only @oracle.com person currently on oss-security (judging by
> the e-mail addresses) appears not to be involved with Oracle Enterprise
> Linux specifically.

There are other ways to subscribe to this list than email. See:
http://oss-security.openwall.org/wiki/mailing-lists/oss-security

> Can you please add your info to the following wiki pages?
> http://oss-security.openwall.org/wiki/vendors

Done,

Thanks,
-Chandan
--
Oracle Security Alerts

Attachment: signature.asc
Description: OpenPGP digital signature