From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: Re: FW: [oss-security] accepting new members to (linux-)distros lists Date: Mon, 10 Jul 2017 17:56:18 +0200 Message-ID: <87k23g1e1p.fsf@gnu.org> References: <20170628213609.GA14802@jasmine.lan> <87efu3h015.fsf@gmail.com> <20170707191840.GA26371@jasmine.lan> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:35367) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dUb2u-0004x5-Ak for guix-devel@gnu.org; Mon, 10 Jul 2017 11:56:25 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dUb2r-0000Pz-8E for guix-devel@gnu.org; Mon, 10 Jul 2017 11:56:24 -0400 In-Reply-To: <20170707191840.GA26371@jasmine.lan> (Leo Famulari's message of "Fri, 7 Jul 2017 15:18:40 -0400") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org Leo Famulari skribis: > On Thu, Jun 29, 2017 at 12:48:22PM +0800, Alex Vong wrote: >> Leo Famulari writes: >>=20 >> [...] >> > But, the "Stack Clash" issues took us by surprise and we spent a few >> > days writing and testing our fixes. We are committed to supporting >> > 32-bit platforms where these bugs are apparently easy to exploit. >> > Without access to the exploits or detailed discussion, it was very >> > difficult to know if our fixes actually worked. So, we could have >> > responded more quickly and effectively with early notice. >> [...] >>=20 >> Should we bring this discussion to nix devs as well? I am sure they are >> facing the same issue of not having early access to vulnerabilities. It >> will be insightful to know how they dealt with it in the past and their >> opinions on joining the list. > > If somebody who has a relationship with the Nix team would like to > discuss it with them, I'd be happy to hear the result, but I don't > really have time for it right now. Also, we would not be able to discuss > embargoed bugs from linux-distros with them, according to the list > policy. > > Besides, I think our present situation and practices regarding security > updates is very different from Nix's. They have different tools for > shipping security updates, and they do the "stable" branch thing. Indeed. We can learn by working with each other in general, but for this particular topic I think it wouldn=E2=80=99t be that helpful. In addi= tion to having different tools and practices, Nix and Guix are simply different distros. Ludo=E2=80=99.