Re: Announcement regarding the oss-security mailing list

[Ricardo Wurmus <rekado@elephly.net>]

Leo Famulari <leo@famulari.name> writes:

> I think that several of us are subscribed to oss-security as part of our
> effort to learn about upstream security issues in a timely manner.
>
> A couple days ago, MITRE decided to stop assigning CVEs from the list:
>
> http://seclists.org/oss-sec/2017/q1/351
>
> So, I expect that we will see fewer bugs sent to oss-security, and Guix
> developers interested in package security may need to adjust their
> approach to learning about such bugs.
>
> Let's share some tips on where to find this information.
>
> I look at the lwn.net security advisories, the Debian security-announce
> mailing list, `guix lint -c cve`, the upstream bug trackers of a handful
> of packages, and even some Twitter personalities.
>
> What about you?

I’m not sure if this is sufficient but it looks like new CVEs are also
listed here:

    https://cassandra.cerias.purdue.edu/CVE_changes/today.html

The added CVEs can also be viewed per day or month.

There’s also an RSS feed:

    https://nvd.nist.gov/download/nvd-rss.xml

A disadvantage (but also a blessing) is that there’s a lot of software
in the feed that we don’t have in Guix.  I would be happy if we had a
system to give us more *relevant* warnings.  (Running “guix lint -c cve”
regularly and shooting off notifications…?)

--
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
https://elephly.net