From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ricardo Wurmus Subject: Re: Announcement regarding the oss-security mailing list Date: Sat, 11 Feb 2017 21:05:32 +0100 Message-ID: <87k28w7asz.fsf@elephly.net> References: <20170211194400.GA10091@jasmine> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:48450) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ccdvS-0007PB-I5 for guix-devel@gnu.org; Sat, 11 Feb 2017 15:05:44 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ccdvP-0003zo-Do for guix-devel@gnu.org; Sat, 11 Feb 2017 15:05:42 -0500 Received: from sender-of-o51.zoho.com ([135.84.80.216]:21026) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ccdvO-0003zU-VO for guix-devel@gnu.org; Sat, 11 Feb 2017 15:05:39 -0500 In-reply-to: <20170211194400.GA10091@jasmine> List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Leo Famulari Cc: guix-devel@gnu.org Leo Famulari writes: > I think that several of us are subscribed to oss-security as part of our > effort to learn about upstream security issues in a timely manner. > > A couple days ago, MITRE decided to stop assigning CVEs from the list: > > http://seclists.org/oss-sec/2017/q1/351 > > So, I expect that we will see fewer bugs sent to oss-security, and Guix > developers interested in package security may need to adjust their > approach to learning about such bugs. > > Let's share some tips on where to find this information. > > I look at the lwn.net security advisories, the Debian security-announce > mailing list, `guix lint -c cve`, the upstream bug trackers of a handful > of packages, and even some Twitter personalities. > > What about you? I’m not sure if this is sufficient but it looks like new CVEs are also listed here: https://cassandra.cerias.purdue.edu/CVE_changes/today.html The added CVEs can also be viewed per day or month. There’s also an RSS feed: https://nvd.nist.gov/download/nvd-rss.xml A disadvantage (but also a blessing) is that there’s a lot of software in the feed that we don’t have in Guix. I would be happy if we had a system to give us more *relevant* warnings. (Running “guix lint -c cve” regularly and shooting off notifications…?) -- Ricardo GPG: BCA6 89B6 3655 3801 C3C6 2150 197A 5888 235F ACAC https://elephly.net