Re: illumos (or at least danmcd) membership in the distros list

[Alan Coopersmith <alan.coopersmith () oracle com>]

On 9/13/23 13:21, Dan McDonald wrote:
> > • Have a publicly verifiable track record, dating back at least 1 year and continuing to present day, of fixing security 
> > issues (including some that had been handled on (linux-)distros, meaning that membership would have been relevant to you) 
> > and releasing the fixes within 10 days (and preferably much less than that) of the issues being made public (if it takes you 
> > ages to fix an issue, your users wouldn't substantially benefit from the additional time, often around 7 days and 
> > sometimes up to 14 days, that list membership could give you)

For this criteria I think you'd want to point to either the github logs
or release announcements for the distros themselves (OpenIndiana,
SmartOS, OmniOS, etc.) as it's asking for the history of the distro in
security response.   I don't think the illumos-gate has any relevant
history for this criteria - you can certainly show fixing security bugs
in that code base, but I don't think any of them would have been shared
on the distros list, as illumos-gate only contains a small number of
externally maintained FOSS packages - most illumos distros add many more
FOSS packages on top of what the gate ships, and its those FOSS packages
(things like curl, cups, git, sudo, etc.) that info is shared about on the
distros list, as you can see at https://www.openwall.com/lists/distros/ .

> > • Have someone already on the private list, or at least someone else who has been active on oss-security for years but is 
> > not affiliated with your distro nor your organization, vouch for at least one of the people requesting membership on behalf 
> > of your distro (then that one vouched-for person will be able to vouch for others on your team, in case you'd like 
> > multiple people subscribed)
>
> Per above, I believe someone on this maling list can vouch for me.

I am on the distros list, and have been active on oss-security for years,
and can vouch for Dan personally.

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris