oss-sec mailing list archives
Re: Adding Xen.org contact to linux-distros security list
From: Solar Designer <solar () openwall com>
Date: Sat, 4 Feb 2012 03:07:21 +0400
On Fri, Feb 03, 2012 at 09:33:05AM +0000, Ian Campbell wrote:
Would it be possible for myself to be subscribed to the linux-distros security list as a representative of Xen.org?
I think not. We had a few exceptions like this on vendor-sec, but when setting up the linux-distros list I proposed not to be making such exceptions anymore and everyone seemed to agree. In fact, that's even reflected in the list name - on purpose. Thanks for bringing the topic up anyway. It helps to know what's in demand and see what solutions we have (or don't have).
Although Xen.org is not a distro we do incorporate upstream software and one of our upstreams (qemu) uses this list as their embargoed security announcement channel. We would like to be able to co-ordinate the release of fixes into our own qemu trees.
I think you should contact the QEMU folks and ask them to CC you on relevant notifications. I think they will start doing it if they don't mind. And if they do mind, then it'd be inappropriate to bypass that. Meanwhile, I've edited this wiki page: http://oss-security.openwall.org/wiki/mailing-lists/distros to ask reporters to consider notifying not only distro vendors, but also affected Open Source projects (if applicable). Specifically: "If the security issue you're reporting affects other systems as well (from vendors not represented on these lists), please consider notifying other affected distro vendors and/or Open Source projects as well and mention what you're doing on this or what you'd like done on it in your notification to the list." where "distro vendors" and "Open Source projects" are links to: http://oss-security.openwall.org/wiki/vendors http://oss-security.openwall.org/wiki/software You could want to add Xen.org contact information to the latter page. Alexander
Current thread:
- Adding Xen.org contact to linux-distros security list Ian Campbell (Feb 03)
- Re: Adding Xen.org contact to linux-distros security list Kurt Seifried (Feb 03)
- Re: Adding Xen.org contact to linux-distros security list Solar Designer (Feb 03)
- Re: Adding Xen.org contact to linux-distros security list Ian Campbell (Feb 05)