Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: non-Linux advance notification list
From: Solar Designer <solar () openwall com>
Date: Sat, 28 Jan 2012 05:18:57 +0400

Hi,

I would definitely like OpenBSD to be represented on the distros list.
Not only OpenBSD ports, but also OpenBSD base.

On Sat, Jan 28, 2012 at 12:39:19AM +0000, Stuart Henderson wrote:
Could you add myself for OpenBSD ports please? If acceptable I'll send a
public key out of band. Thanks.

Probably yes, but I (and maybe others) would like some info first:

Is there any web page (or something else) specifying the OpenBSD ports
security team (not all committers, but just those the project vouches
for as it relates to handling of non-public security vulnerabilities)?
Or a port-security@ exploder that you're on.  Or explicit approval
(vouching for you) by a key OpenBSD person for this specific occasion.

(For NetBSD and FreeBSD, the folks subscribed were "visibly" on security
teams.)

Is there any place where we can see past security issues in OpenBSD
ports handled (which issues, when fixed)?  Something like a changelog
with security fixes marked specially, or advisories?

Would advance notifications result in you actually preparing OpenBSD
port updates in time for public disclosure?

How would you handle notifications that happen to pertain to components
that are in OpenBSD base tree rather than ports?

BTW, note how my current approach differs from what was used on
vendor-sec: I ask projects themselves (known and reputable) to vouch for
folks to be added on their behalf, whereas on vendor-sec some existing
list members would vouch for a new member.  I'd appreciate any comments
anyone might have on this.

Thanks,

Alexander


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]