Re: Closed list

[Drew Yao <ayao () apple com>]

Hello Alexander,

It seems that you're not opposed to Apple's inclusion on the list. Would you reconsider and allow us on the list?  

In an earlier mail, you mentioned 
"For just one vendor, we can be CC'ing you whenever appropriate, with no list needed." We ship a lot of open source 
software, and outside of Apple, very few people would be qualified to know whether or not we ship any given piece of 
OSS, especially since we sometimes add new projects to the next, unreleased version of Mac OS X.

Regarding the question of where to draw the line for allowing non-Linux distros to the table, I'd say we've earned our 
place by sending numerous internally discovered bugs to vendor-sec, as well as coordinating disclosure of open source 
projects like CUPS that we maintain.

We'd want both me and <Jeffrey Czerniak <jeffcz () apple com> on the list, both using the PGP key found at 
https://www.apple.com/support/security/pgp/ 

---
Drew Yao
Apple Product Security




On Apr 5, 2011, at 9:18 AM, Solar Designer wrote:

> I wish we had this discussion for real a month ago, but apparently most
> folks won't comment until the setup of a closed list becomes a reality.
> So I think there was some use in setting it up even if we end up re-doing
> or removing it, which is within consideration. ;-)
>
> On Tue, Apr 05, 2011 at 09:40:13AM -0600, Vincent Danen wrote:
> > A lot of userland stuff is shared between BSD and Linux, and probably
> > some other operating systems.  About the only things that differ between
> > a lot of these are the Linux kernel, and the *libc.
>
> There are also userland tools specific to the Linux kernel, there's
> Linux-PAM, there are package managers that are rarely used on non-Linux.
>
> I mostly agree with you, though.
>
> > I think if the disqualifier to Apple is that they don't ship a Linux
> > kernel and glibc, then we're doing them (and ourselves) a disservice.
> > Apple contributed a lot to vendor-sec (and I'm not going all pro-Apple
> > here, just stating a fact).
>
> Yes.
>
> > I think it would be reasonable to s/Linux list/open source vendor list/,
> > like vendor-sec used to be.
>
> If it's not just Linux, then where do we draw the line?  Do we accept
> Solaris distros (of which there are several), Haiku, ReactOS, Cygwin,
> and who knows what else (no offense intended to any of these fine
> projects)?  I think this would make leaks and misuse of the information
> significantly more likely, and make some members and reporters
> uncomfortable about posting to the list.  So we'll be back to CC lists.
>
> > ... letting Apple/FreeBSD/OpenBSD/etc. have a seat at our table.
>
> I am comfortable about "Apple/FreeBSD/OpenBSD", but not about "etc." -
> so we'd be forced to introduce a vouching system (well, maybe we'd be
> forced to do that for Linux distros as well...)
>
> Alexander