Re: [gentoo-security] Gentoo Linux Vulnerability Treatment Policy

[Tobias Weisserth]

Hi Thierry,

On Tue, 2004-05-18 at 22:05, Thierry Carrez wrote:
> Hello everyone,
>
> We're in the process of publishing Gentoo Official Policy for the
> treatment of vulnerabilities. You can review the latest draft at the
> following location :
>
> http://dev.gentoo.org/~koon/docs/vulnerability-policy.html
>
> Comments welcome.


"Confidential vulnerabilities 

Confidential vulnerabilities (for example coming from developer's direct
communication or restricted vendor-sec lists) should follow a specific
procedure. They should not appear as a public bugzilla entry, but only
in the (private) GLSAMaker tool. They should get corrected using private
communication channels between the GLSA coordinator and the package
maintainer."

What's this about? I can't imagine what a "confidential vulnerability"
might be. This immediately prompts for "security by obscurity" remark,
don't you think?

Otherwise very good work.

I'm back in the game by the way. I had to wait about 4 weeks until my
replacement drive came in after my fatal crash and I have now a machine
with Gentoo again. Thank God ;-)

I am going to buy another spare hard drive with another installation on
it so my machine won't fail on me in the future with these consequences.
Though I have to admit that a few weeks with less computer usage have
really been worthwhile ;-)

I have started monitoring full-disclosure and bugtraq again, already
commencing entering bugs into bugzilla.

Mandrake has a nice link collection:

http://www.mandrakesecure.net/en/secsites.php

These would be good candidates to skim through too. Add the
announcements of all the other big distributions and that should cover a
great deal of relevant channels.

regards,
Tobias W.



--
gentoo-security@g.o mailing list