oss-sec mailing list archives
Re: Why send bugs embargoed to distros?
From: ludo () gnu org (Ludovic Courtès)
Date: Sun, 24 Sep 2017 22:15:08 +0200
Hi, Hanno Böck <hanno () hboeck de> skribis:
I had informed the distros mailing list one week earlier about the upcoming disclosure with a bug description and links to the already available patch. My understanding is that the purpose of the distros list is that updates can be prepared so after a disclosure the time between "vuln is known" and "patch is available" is short. However from all I can see this largely didn't happen.
FWIW, for GNU Guix (which doesn’t have anyone yet on the distros list), we pushed the patch less than 30 minutes after the public disclosure on oss-sec¹. The fact that your message to oss-sec was very clear on the issue and its consequences, and contained a link to the (small) patch surely made it easier to prepare the fix. Ludo’. ¹ https://git.savannah.gnu.org/cgit/guix.git/commit/?id=e14ab0ad070b4eafa19fc1df81b7b5c3de1dc1b2
Current thread:
- Why send bugs embargoed to distros? Hanno Böck (Sep 23)
- Re: Why send bugs embargoed to distros? Levente Polyak (Sep 23)
- Re: Why send bugs embargoed to distros? Anthony Liguori (Sep 23)
- Re: Why send bugs embargoed to distros? Simon McVittie (Sep 23)
- Re: Why send bugs embargoed to distros? Marc Deslauriers (Sep 23)
- Re: Why send bugs embargoed to distros? Kurt H Maier (Sep 23)
- Re: Why send bugs embargoed to distros? Till Dörges (Sep 23)
- Re: Why send bugs embargoed to distros? Marcus Meissner (Sep 23)
- Re: Why send bugs embargoed to distros? Ludovic Courtès (Sep 24)
- Re: Why send bugs embargoed to distros? Igor Seletskiy (Sep 24)
- Re: Why send bugs embargoed to distros? John Haxby (Sep 25)
- Re: Why send bugs embargoed to distros? Cliff Perry (Sep 25)
- Re: Why send bugs embargoed to distros? Leo Famulari (Sep 25)
- Re: Why send bugs embargoed to distros? Levente Polyak (Sep 23)