oss-sec mailing list archives

Re: accepting new members to (linux-)distros lists


From: Solar Designer <solar () openwall com>
Date: Fri, 14 Jul 2017 20:54:02 +0200

On Fri, Jul 14, 2017 at 12:40:18PM -0600, kseifried () redhat com wrote:
Sorry I thought I'd replied earlier to this thread

IIRC, you did, but you were not specific.

(phone email clients,
how do they work?) Red Hat will continue to help (let's pick #1 and #2
explicitly),

What's #1 and #2 - do you mean the technical or the administrative tasks?

Technical are:

1. Propose (other) ways to fix, work around, or mitigate the reported issues

2. Develop and share fixes, workarounds, or mitigations

and currently these are vacant.

Administrative are:

1. Promptly review new issue reports for meeting the list's requirements
and confirm receipt of the report and, when necessary, inform the
reporter of any issues with their report (e.g., obviously not actionable
by the distros) and request and/or propose any required yet missing
information (most notably, a tentative public disclosure date) -
primary: CloudLinux, backup: vacant

2. If the proposed public disclosure date is not within list policy,
insist on getting this corrected and propose a suitable earlier date -
primary: CloudLinux, backup: vacant

As you can see, the primary distro for them is currently CloudLinux, and
as discussed in here I'd like each new distro joining to take at least
task 1, unless they strongly prefer something else.  There's currently
no backup, so I will gladly list Red Hat as backup here if you confirm.

I know we already have more than 2 people on the list so I
don't think we need to nominate a backup?

If you're confident you'll fully handle a task without needing a backup
distro, then we may list that as such.  Right now, you do have Debian
listed as backup for the CVE tasks, though.

Alexander


Current thread: