Re: unresponsive distros

[Solar Designer <solar () openwall com>]

On Thu, Jun 01, 2017 at 08:00:53PM +0200, Solar Designer wrote:
> As far as I can tell, MontaVista never posted to the list.

I was wrong.  I now found that they posted two messages in January 2012
and August 2012, but that's all.  There was also some participation here
on oss-security, and IIRC previously on vendor-sec.

> Being a user of the info
> only, without participation in discussions, is not strictly disallowed,
> but this time it's coupled with lack of response when specifically asked
> to respond, and on an issue that is at least potentially relevant to the
> distros (not just a responsiveness test).

On a related note, I think we should continue to allow distros with just
one representative subscribed.  Some projects are genuinely small (which
doesn't mean their userbase is proportionally small) - e.g., Slackware.
Some have tiny security teams (even one-person) or few people who
actually do stuff.  This does mean they will miss tests if that person
is e.g. on vacation.  This also means they will occasionally miss real
issues (non-tests), and not only on the distros list.  But this doesn't
fully disqualify them.

In fact, currently I am a single point of failure for many aspects of
running the distros list.  Maybe I need to address that, but it's tricky
to do without adding risks.

Maybe it's more reasonable to require some participation - e.g., if you
commented during the embargo period negotiation, that would have
demonstrated you care.  Even if you said e.g. that you defer to others.
Noise?  Not exactly.  Not when such feedback was explicitly requested by
the reporter, and they got very few responses.  (Here "you" can refer to
any distro, especially one with otherwise little observable activity.)

Alexander