3 ms·
Interesting, who else are involved in the embargoes? Anywhere I could read more about this?
by symlinkk 6y ago
Interesting, who else are involved in the embargoes? Anywhere I could read more about this?
- mbakke 6y agoEmbargos are coordinated on the "linux-distros" mailing list: https://oss-security.openwall.org/wiki/mailing-lists/distros https://oss-security.openwall.org/wiki/mailing-lists/distros
- Twirrim 6y agoIt depends on where the vulnerability is. Everything is all ad-hoc, each piece of open source software decides how they want to handle it, attempting to juggle the chances of a leak. The fewer you tell, the more likely the secret is to be kept, and you want to keep these things secret until a patch is done. The linux kernel maintainers have a private list where they co-ordinate some of this stuff, and every major Linux distribution will have engineers on it. That's partly why you see things like OpenBSD etc. being left on the margins. Certain maintainers have been quite vocal about not adhering to embargoes, which really doesn't help them. It's an idealist vs pragmatist thing going on there.