oss-sec mailing list archives
Re: Linux kernel CVEs not mentioned on oss-security
From: Solar Designer <solar () openwall com>
Date: Wed, 27 Sep 2017 17:09:18 +0200
On Mon, Sep 25, 2017 at 09:50:59PM +0000, Priedhorsky, Reid wrote:
1. Is oss-security's coverage of security issues in open-source software intended to be comprehensive?
As others have said, no. (I think that would be an unrealistic goal. It could also result in so much traffic we'd have to think of splitting the list e.g. into notifications vs. discussions, but arguably that would be a good problem to have.) However, I would like the coverage to increase. When e.g. Debian sends out a security advisory, they shouldn't literally post it in here. We had asked (in list content guidelines) for distro-specific advisories not to be sent in here, for good reasons. However, if Debian and any other distros doing similar have the resources, I'd appreciate it if they bring in here info on vulnerabilities in Open Source software that they're tracking / are about to patch / have already patched / have even issued advisories on, but that haven't been mentioned in here before. Many distros (and/or people from distros' security teams) have been doing just that from time to time, but certainly not consistently. Maybe my encouragement above will help improve this? Alexander
Current thread:
- Re: Linux kernel CVEs not mentioned on oss-security, (continued)
- Re: Linux kernel CVEs not mentioned on oss-security Salvatore Bonaccorso (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Brad Spengler (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Bob Friesenhahn (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Agostino Sarubbo (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Marcus Meissner (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Bob Friesenhahn (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 26)