Home page logo

oss-sec logo oss-sec mailing list archives

Re: Adding Xen.org contact to linux-distros security list
From: Solar Designer <solar () openwall com>
Date: Sat, 4 Feb 2012 03:07:21 +0400

On Fri, Feb 03, 2012 at 09:33:05AM +0000, Ian Campbell wrote:
Would it be possible for myself to be subscribed to the linux-distros
security list as a representative of Xen.org?

I think not.  We had a few exceptions like this on vendor-sec, but when
setting up the linux-distros list I proposed not to be making such
exceptions anymore and everyone seemed to agree.  In fact, that's even
reflected in the list name - on purpose.

Thanks for bringing the topic up anyway.  It helps to know what's in
demand and see what solutions we have (or don't have).

Although Xen.org is not a distro we do incorporate upstream software and
one of our upstreams (qemu) uses this list as their embargoed security
announcement channel. We would like to be able to co-ordinate the
release of fixes into our own qemu trees.

I think you should contact the QEMU folks and ask them to CC you on
relevant notifications.  I think they will start doing it if they don't
mind.  And if they do mind, then it'd be inappropriate to bypass that.

Meanwhile, I've edited this wiki page:


to ask reporters to consider notifying not only distro vendors, but also
affected Open Source projects (if applicable).  Specifically:

"If the security issue you're reporting affects other systems as well
(from vendors not represented on these lists), please consider notifying
other affected distro vendors and/or Open Source projects as well and
mention what you're doing on this or what you'd like done on it in your
notification to the list."

where "distro vendors" and "Open Source projects" are links to:


You could want to add Xen.org contact information to the latter page.


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]