oss-sec mailing list archives

Re: illumos (or at least danmcd) membership in the distros list


From: Solar Designer <solar () openwall com>
Date: Fri, 15 Sep 2023 23:09:06 +0200

Hi Dan,

Your request looks good to me, except that this criterion:

On Wed, Sep 13, 2023 at 08:21:22PM +0000, Dan McDonald wrote:
Have a publicly verifiable track record, dating back at least 1 year and continuing to present day, of fixing 
security issues (including some that had been handled on (linux-)distros, meaning that membership would have been 
relevant to you) and releasing the fixes within 10 days (and preferably much less than that) of the issues being 
made public (if it takes you ages to fix an issue, your users wouldn't substantially benefit from the additional 
time, often around 7 days and sometimes up to 14 days, that list membership could give you)

is meant to be about the distro, not about you personally.

Alan Coopersmith also correctly pointed this out and made suggestions.

Can you show illumos fixing non-illumos-only security issues within days
after public disclosure, so that a few days of advance notice would have
made those fixes even quicker?

Thanks,

Alexander


Current thread: