Vulnerabilities not affecting Debian: reporting proposal

2007-07-11 Thread Alexander Konovalenko
I would like to propose that Debian security teams publish a short report each time they review a vulnerability in a program that's included in Debian and find that the vulnerability does *not* affect Debian. Problem description When I maintain a secure machine, I naturally want to keep it

Re: Vulnerabilities not affecting Debian: reporting proposal

2007-07-11 Thread Martin Schulze
Alexander Konovalenko wrote: Proposed solution Do you know about http://www.debian.org/security/nonvulns-etch Regards, Joey http://www.debian.org/security/nonvulns-sarge -- It's time to close the windows. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of

Re: Vulnerabilities not affecting Debian: reporting proposal

2007-07-11 Thread Alexander Konovalenko
On 7/11/07, Martin Schulze [EMAIL PROTECTED] wrote: Do you know about http://www.debian.org/security/nonvulns-etch Oh, that's great. I should have read the website more carefully! Thanks. What about providing a more elaborate summary for some issues? Some entries merely say that the bug is

Re: Vulnerabilities not affecting Debian: reporting proposal

2007-07-11 Thread Martin Schulze
Alexander Konovalenko wrote: On 7/11/07, Martin Schulze [EMAIL PROTECTED] wrote: Do you know about http://www.debian.org/security/nonvulns-etch Oh, that's great. I should have read the website more carefully! Thanks. What about providing a more elaborate summary for some issues? Some

Re: Vulnerabilities not affecting Debian: reporting proposal

2007-07-11 Thread Stefan Fritsch
Hi, Alexander Konovalenko wrote: I couldn't find any existing solutions to the problem described above. The testing security team does publish some of the information in their Secure-testing-commits, but it lacks more verbose explanations and is more of a tool for team members than a source

Re: [Secure-testing-team] Vulnerabilities not affecting Debian: reporting proposal

2007-07-11 Thread Alec Berryman
Alexander Konovalenko on 2007-07-11 16:59:00 +0400: When I maintain a secure machine, I naturally want to keep it secure against known attacks. I subscribe to Bugtraq and a CVE-compatible vulnerability database and watch them closely for anything that could affect my machine. When an advisory