From mboxrd@z Thu Jan 1 00:00:00 1970 From: ng0 Subject: Re: Announcement regarding the oss-security mailing list Date: Sat, 11 Feb 2017 20:10:21 +0000 Message-ID: <20170211201021.dkf2na3wbrf3dads@wasp> References: <20170211194400.GA10091@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48807) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ccdyS-0008LW-Sz for guix-devel@gnu.org; Sat, 11 Feb 2017 15:08:52 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ccdyP-0004px-2O for guix-devel@gnu.org; Sat, 11 Feb 2017 15:08:48 -0500 Received: from fragranza.investici.org ([178.175.144.26]:64178) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ccdyO-0004pf-Mm for guix-devel@gnu.org; Sat, 11 Feb 2017 15:08:44 -0500 Content-Disposition: inline In-Reply-To: <20170211194400.GA10091@jasmine> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org On 17-02-11 14:44:00, Leo Famulari wrote: > I think that several of us are subscribed to oss-security as part of our > effort to learn about upstream security issues in a timely manner. > > A couple days ago, MITRE decided to stop assigning CVEs from the list: > > http://seclists.org/oss-sec/2017/q1/351 > > So, I expect that we will see fewer bugs sent to oss-security, and Guix > developers interested in package security may need to adjust their > approach to learning about such bugs. > > Let's share some tips on where to find this information. > > I look at the lwn.net security advisories, the Debian security-announce > mailing list, `guix lint -c cve`, the upstream bug trackers of a handful > of packages, and even some Twitter personalities. > > What about you? I subscribe to mailing lists (not a recommendation though) of upstream, then there's GLSA (Gentoo Linux Security Announcement) which occasionaly helps, and there is https://www.cvedetails.com And the normal sources.. like being part of upstream, tracking another upstream because you need it for your work, knowing people, etc. -- ng0 -- https://www.inventati.org/patternsinthechaos/