oss-sec mailing list archives
CVE REJECT noise
From: Solar Designer <solar () openwall com>
Date: Thu, 20 Aug 2015 00:42:25 +0300
All - Can we please agree that CVE REJECT postings such as those Kurt has been occasionally making in here for a while are not to be made anymore? To me, and I suspect to almost(?) all other oss-security subscribers, they are just noise. I mean things like this: http://www.openwall.com/lists/oss-security/2015/08/18/9 "Subject: CVE REJECT CVE-2015-5192/CVE-2015-5193 Please CVE REJECT CVE-2015-5192/CVE-2015-5193 I misread a request and assigned CVE's twice to two issues, so one set needs to be rejected." I am fine with postings that talk in some detail about issues that are already public and also mention that a CVE ID should be rejected. I am not fine with postings the only purpose of which is to announce that a CVE ID is being rejected, especially if those postings fail to mention the product and the vulnerability. I understand that for CVE IDs assigned in private to issues that are not yet public it would be inappropriate to include this detail in a public posting, but to me this also means that a public posting shouldn't be made. I did bring this up with Kurt in private e-mail a few months ago, and Kurt responded with some arguments in favor of continuing this practice. Yet I think it has to end. If anyone on this list besides Kurt thinks otherwise, please let us all know and explain why you personally found those postings useful. Otherwise I'll consider it a decision made, and will expect no further postings of this sort. Thanks, Alexander
Current thread:
- CVE REJECT noise Solar Designer (Aug 19)
- Re: CVE REJECT noise Kurt Seifried (Aug 19)
- Re: CVE REJECT noise Solar Designer (Aug 19)
- Re: CVE REJECT noise Reed Loden (Aug 19)
- Re: CVE REJECT noise P J P (Aug 20)
- Re: CVE REJECT noise Solar Designer (Aug 19)
- Re: CVE REJECT noise David Walser (Aug 19)
- Re: CVE REJECT noise Kurt Seifried (Aug 19)