oss-sec mailing list archives

Re: help wanted - bring more issues in here


From: Solar Designer <solar () openwall com>
Date: Fri, 8 Mar 2024 21:54:17 +0100

Hi,

So far, I only heard from Katherine Mcmillan (and suggested a first task
to her off-list).  Any other volunteers, please?

BTW, for quoting web page content, I use ELinks in a terminal window set
to width 80 (and arbitrary height), and use "Save formatted document"
from there.  Then in the resulting text file, review the list of links
at the end and remove duplicate and irrelevant ones.  (Some of this can
later be automated, if we do it a lot.)  The text file can then be
either included in the message body (but you need to clearly distinguish
it from your own writing) or attached (as text/plain, please).

On Thu, Mar 07, 2024 at 05:17:03PM -0800, Alan Coopersmith wrote:
I also notice far more than I can send on myself, so tend to filter both
for those projects that are more likely to be distributed directly by
distros and more widely installed on systems, and for issues that seem
to have a higher level of impact.  So I'm not sending on notice of every
bug in every WordPress plugin, nor every npm module.

If people want to see different coverage here, speaking up can change that,
but helping out as described above will make an even bigger impact.

I think we don't need a different coverage aka lower threshold (but yes,
speaking up can change that).  I think there are still many issues and
news above the current threshold that are not getting reported in here.

As to lower overall severity issues, such as those in some project's
obscure third-party plugins, I think it'd be good to have regular
digests on those, like it's already being done for Jenkins plugins, not
per-issue messages.  So if anyone keeps track of e.g. WordPress plugin
or npm module issues (Alan's examples above) and is willing to produce
digests, please feel free.

Thanks,

Alexander


Current thread: