Re: Request for linux-distros subscription

[Ramon de C Valle <rdecvalle () vmware com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi Russ,

- ----- Original Message -----
> From: "Russ Allbery" <eagle () eyrie org>
> To: oss-security () lists openwall com
> Cc: kseifried () redhat com, "Monty Ijzerman" <mijzerman () vmware com>
> Sent: Thursday, June 5, 2014 2:37:57 AM
> Subject: Re: [oss-security] Request for linux-distros subscription
>
> Ramon de C Valle <rdecvalle () vmware com> writes:
>
> > By fixing in advance, I mean to have the fixes/updates ready by the time
> > the vulnerability is publicly disclosed. (However, in the case of cloud
> > services, we may not have how to know if the fix was, in fact,
> > applied/made in advance.)
>
> This is obviously of huge business value to VMware as a company.  I'm
> missing how your ability to do this for your product is of value to the
> open source community, however.  What is VMware bringing to the table here
> in terms of value provided to the other members of linux-distros due to
> having VMware as a member?
I don't see why we also couldn't help in coordinating, discussing, fixing, and reporting issues like any other company 
on the list (and also fixing and reporting issues in the, albeit fewer than some, OSS we contribute and/or maintain).

> This is an honest question.  There may well be substantial value that I'm
> not seeing.
>
> Alternately, I could also understand if your argument is that this is not
> the calculus that was used to judge other, current members, or that the
> criteria for membership should be the simple question of whether the
> organization uses Linux and related software and would benefit from
> advance notification of security vulnerabilities.  (By that argument,
> other organizations, such as Apple, should also be eligible for
> membership.)
>
> An aside: I personally, speaking as someone who is not a member but who
> has reported embargoed security vulerabilities to linux-distros in the
> past and doubtless will in the future, would prefer to restrict
> linux-distros membership to the organizations that are actively
> contributing to the security of open source software in ways beyond simply
> redistributing it.  In other words, I would prefer if linux-distros were
> restricted to only organizations with active security teams and a track
> record of finding vulnerabilities, developing fixes, coordinating security
> fixes among open source distributions, or contributing substantially to
> those groups that are doing so.
>
> I view advance notification as a valuable courtesy to help Linux
> distributions make their products more secure, and would prefer to only
> extend that courtesy to those organizations who have contributed something
> back to the community of which I'm part.  Organizations that choose not to
> contribute substantially can receive notification at the same time as the
> general public.
>
> This is a possibly idiosyncratic opinion, and I know it is not the current
> criteria for membership.
>
> --
> Russ Allbery (eagle () eyrie org)
> <https://urldefense.proofpoint.com/v1/url?u=http://www.eyrie.org/~eagle/&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=bZpuVimtRQUx3xHFIlu%2BaciWn3GMzM%2FBnwDoBm5jP8U%3D%0A&m=V2wmorukYIBYtiXkAXEmSrqwlyoex1NNLXyt0N07vjQ%3D%0A&s=e2d7c4b82f165ccb53d49dd859898e0609f499f23cb2e0fda92f9edb12714a59>
- --
Ramon de C Valle
VMware Product Security Engineering
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org

iQIcBAEBCgAGBQJTkA0vAAoJEMHrzpMNBOIM2vUP/34gs7SAVNl3UC36kplWqLo5
6nIVb331/ZbIiAREqtCFSGOXJLsyMDaTza7Mc1CeAIECsTyL5OYQur7dFvNKihjc
m08qMp9VY/2CFOWaOy+9DIgFBNZszHDR2ubZILuiAfkBglfXorV97MC7lw04+nOc
+aipYhAk90+yp6KNB1Wp7R05LOyfChF2INPXBqEqCynv+RVJGm/Ql2njhEAY2jNb
D6YbaA6PIYPhwpAZ924tOi915NYFU1Iu+/HBUdZL0uHFzVKU5j1MU00fqKtEmlGf
7B2osKWJf6l3iDm0POlKKiBfYlEYeTkcdUpXgm2i0GrobQRY0DMMwmUJzSWT3Azk
lYfPzI0CLbunn3JVMySpwzD8PKAGYxBVekQbGBS7U1wxic2Kmpb/7Lo1V2/By8Hv
Aq2S53abDeS8QbFsY9nmPvFIT4HQ8SLVbgZdxQ8/lVYVuRTBDEZaw4yk6auLHOei
rfhNMa3yu+nPybMQPTIcTGhqIQGaQdqddurJSUEihvSo4NRxiA/39WcRrp5He+b8
Uk9z7ZTVkRlZWMIpjNBmu3r7g1e+59lXbLXX5m5Wly4D3D6useKjIFj0QO59+ZhS
y0veiB9wsOIWSCXmbL+IuZYRNkl+v2NADWCqowE6d9YQHnzzA0P+e83GFUb16dz1
T6I97jlSkczdNvI5GGZN
=esNG
-----END PGP SIGNATURE-----