oss-sec mailing list archives

Re: non-Linux advance notification list


From: Solar Designer <solar () openwall com>
Date: Mon, 28 Nov 2011 03:13:50 +0400

All -

On Mon, Nov 28, 2011 at 02:56:22AM +0400, Solar Designer wrote:
OK, now this is starting to look about as ridiculous as the old "closed
list" thread did. ;-)  I am approving these messages so far in part
because I think they serve as (valid) criticism of the idea of such
lists, even if the senders did not intend such meaning.  I have mixed
feelings about these advance notification lists myself.

Oh, I think I need to clarify.  By "these messages" above, I mean closed
list membership requests that lack justification.  I can see how my
positive reply to Tim's message might have created the false impression
that no justification was required.  In fact, NetBSD/pkgsrc had previously
expressed interest in being on such a list (during the "closed list"
thread from half a year ago), Tim posted from his @pkgsrc address, and I
verified that he was credited for pkgsrc security work just recently:

http://mail-index.netbsd.org/current-users/2011/10/03/msg017924.html

"pkgsrc security: OBATA Akio, Guillaume Lasmayous, Fredrik Pettai, Tim
Zingelman"

None of these things were true for Joost's and Michael's requests - so I
had no better choice than to ask them for justification.

It'd help avoid any confusion like that if further requests include
justification in a more explicit form, even when the sender can
reasonably expect that I'd recognize their OS and themselves and their
involvement in security work for their OS.  While I did recall past
discussions and notice the @pkgsrc address, not everyone did, which
clearly caused confusion.

Thanks,

Alexander


Current thread: