3 ms·
Related to open source, you probably want to track OSS Security mailing list [1]; or if you're part of an organization relying on open source software, you shou
by reidrac 11y ago
Related to open source, you probably want to track OSS Security mailing list [1]; or if you're part of an organization relying on open source software, you should have someone looking at that list.
I think it is a good complement to the security advisories of your Linux distributor (Debian, CentOS, whatever), but is isn't free as you'll need time to keep an eye on it.
1: http://oss-security.openwall.org/ http://oss-security.openwall.org/
- mbrock 11y agoThanks. Regarding cost... someone should sell curated security feeds to startups. There must be many dozens of engineers who monitor mailing lists for issues in (let's say) ElasticSearch. They could be incentivized to share their findings. Then if one source tags a certain CVE as significant, I get a ping. If several sources tag it, the ping gets more urgent. Eventually I feel scared enough that I upgrade.
- tie_ 11y agoThere was something made to ease exactly that pain... sadly it's no longer updated: http://www.websecuritywatch.com/ http://www.websecuritywatch.com/