Re: membership request to the closed linux-distros security mailing list

[Stuart Henderson <stu () spacehopper org>]

On 2015/03/20 08:16, Anthony Liguori wrote:
> I think the alternative is to formalize what already appears to be the
> existing practice: disclose distros@ on the existence of a
> vulnerability but require direct contact for the details of the
> vulnerability if the submitter/upstream thinks the impact is high.

Are private lists even needed if this policy is taken?