Re: Closed list

[Benji <me () b3nji com>]

> > Benji's trolling does raise a couple real issues

I'm not trolling.

I think your argument for this mailing list is that vulnerabilities need to
be fixed before they're released to the greater public. While I can
understand that, it seems ridiculous to parade yourselves around in public
with a signup system that is akin to


> > Huh?  Now you're with "the other" group that accuses "us" of "hiding"?

Can I not be part of the group that thinks a public signup system for a
mailing list that previously had the mail server owned due to the fact it
was secret (showing interest in possibly owning users now that emails like
mjo () dojo mi org have been confirmed on the list) for a mailing list that is
'embargoed' when really it shouldn't be.

> > What is your opinion on making the list's archive public with a delay(when
the corresponding security issues are already public)?

It would be better. In my opinion, delay would be 1-2 days. Vendor-sec
(alternatives) should be a last resort in publishing issues, other projects
don't get the same "privileges", and have to "make do" with oss-sec. If you
really need such help 'co-ordinating' and fixing things, maybe you should
have a policy to, release advisory/info first, then have a 'co-ordination'
list.


> > Do you really think anyone is gaining new information by discovering
> > that, say, a member of the security team for a major distro will be on
> > this mailing list?  Such information seems pretty obvious to me.

Yes Dan, but now we have private email accounts as well (by people who
apparently don't like to use vendor email addresses) that are also signed up
to this, allowing targeting and easy identification of probably less secure
infrastructure.


Excuse my "trolling" if some of this has already been covered, I'm up early
(for me) and thus can be slightly unintelligible.


On Mon, Apr 4, 2011 at 1:11 AM, Michael Gilbert <michael.s.gilbert () gmail com
> wrote:

> Dan Rosenberg wrote:
>
> > On Sun, Apr 3, 2011 at 6:58 PM, Benji wrote:
> > > This is pathetic. You've all just made your personal and 'work' email
> > > addresses targets by having a ridiculous public 'signup' system, and
> > > the fact you all feel the need to hide behind some sort of veil for
> > > security issues.
> >
> > Do you really think anyone is gaining new information by discovering
> > that, say, a member of the security team for a major distro will be on
> > this mailing list?  Such information seems pretty obvious to me.
>
> Benji's trolling does raise a couple real issues.  The private keys and
> passphrases of those responding here have now become highly lucrative
> targets for attackers.  Hence, everyone on this new list needs to use
> good practices to keep their keys, hard drives, and computers safe.
> There should probably be some common guidelines for key safety for all
> participants.
>
> A private period is rather unfortunate, and hopefully it hasn't been and
> isn't being used as a veil.  I for one am for full transparency
> (especially given Mark Cox's statistic that vendor-sec was only relevant
> for 29 out of over 700 open source issues last year).  However, I
> recognize that there seems to be a need for some private coordination
> at present. Perhaps all discussions should be published in the open
> something like 2 months after the initial posting?  That would be a
> kind of maximum private coordination period.
>
> Best wishes,
> Mike