Re: running the distros lists

[Solar Designer <solar () openwall com>]

On Wed, Mar 14, 2012 at 01:42:23PM -0600, Kurt Seifried wrote:
> Can we also maintain a public database of upstream contacts? I seem to
> remember a few different efforts to do this but can't find anything
> current.

We have this wiki page:

http://oss-security.openwall.org/wiki/software

It currently lists Apache, Asterisk, ..., Xine, X.Org - just to give an
idea of what projects chose to add themselves or were added.  By all
means, please help keep this wiki page current and use it.

We also have:

http://oss-security.openwall.org/wiki/vendors
http://oss-security.openwall.org/wiki/infrastructure

> This would save a ton of time. It would of course have to be
> maintained (maybe a scheme like emailing the people listed every few
> months and offering a "click here to confirm you're still the security
> contact" and a "click here to be removed as the contact" to help keep it
> up to date).

Well, we don't have that currently, and I'm not sure if it'd work well
in practice or not.  I imagine that some upstreams would be offended by
the automated messages, yet they could also be offended by not being
notified of an issue affecting their software (and more importantly
their users would be affected).

> Also things like PGP keys/etc would be nice to have in this.

Right.  Please feel free to add PGP key info to the wiki pages above.

> It strikes me that this would actually be a valuable project for
> Mitre, similar to CPE, maybe the "SCE" ("Security Contact Enumeration")?

Maybe.

> As anyone trying to notify multiple upstreams knows, it can be a
> horribly painful process.

Yes, but my gut feeling is that identifying the right set of projects to
notify is at least as difficult and time-consuming as finding their
current contact info is.  Of course, anything we can do to make any of
the steps easier may be of help.

Kurt - how about my original request for help running the list, though?
Even if you somehow don't volunteer to notify upstreams (and others),
making sure that every issue gets a CRD proposed for it ASAP will be of
help.  Can I at least count on you doing that? ;-)  And maybe someone
else will volunteer for other sub-tasks (although a per-vulnerability
rather than per-sub-task split between the several responsible list
members could work better, I think).

Thanks,

Alexander