Re: accepting new members to (linux-)distros lists

[Kurt Seifried <kseifried () redhat com>]

On Fri, Jul 14, 2017 at 2:57 PM, Solar Designer <solar () openwall com> wrote:

> On Fri, Jul 14, 2017 at 01:52:37PM -0600, Kurt Seifried wrote:
> > Ah I misunderstood the backup, I thought it meant people within a
> distro, not actual distros, I'm fine with a backup distro. As for the tasks
> I meant 1 and 2 technical,
>
> Great.  I've just listed Red Hat for those.
>
> > we generally do this work anyways.
>
> I didn't collect statistics, but my impression is that Red Hat generally
> works on fixes for issues that Red Hat itself brings to distros, which
> is a great contribution (doubly so).  Red Hat also worked on glibc fixes
> for Stack Clash.  Other than that, for issues brought to distros by
> third-parties I think Red Hat's contributions of fixes do not stand out
> compared to some other distros'.  Maybe that will now improve. :-)

To be clear we won't be working on random third party stuff that has
minimal value and we have no expertise in. It's the things like StackGuard
or OpenSSL issues that matter and where a major amount of work is needed
that we tend to work on (we're not going to work on random php apps, we're
going to work on the stuff that matters, not all security issues are
equal).  I would argue if people can't be bothered to care about committing
resources to fixing  a security issue than that security issue doesn't
really matter (in other words, the market has spoken).



> And I am not complaining.  Maybe this means those other distros are
> doing their part too, which is great.
>
> > On Jul 14, 2017, at 12:54, Solar Designer <solar () openwall com> wrote:
> > > Technical are:
> > >
> > > 1. Propose (other) ways to fix, work around, or mitigate the reported
> issues
> > > 2. Develop and share fixes, workarounds, or mitigations
>
> Alexander



-- 

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com