To All, There is an Arch security team, but they don't necessarily have developer access. The strategy is to current report to the arch-security mailing list and file a bug report. I'd just like to know if security issues that are reported are already fixed (since there is a delay for non-distro subscribing lists). Could developers file any security changes they make in the arch-security mailing list as well then? Regards, Mark On Thu, Jun 5, 2014 at 7:13 PM, Daniel Micay <danielmicay@gmail.com> wrote:
On 05/06/14 05:36 PM, Allan McRae wrote:
On 06/06/14 05:14, Mark Lee wrote:
To All,
There are several linux-distro subscription requests on the oss-security mailing list, and some bugs are disclosed first on that mailing list. I just want to be sure that Arch Linux is getting this expedited notification of bugs. Are you still on it Allan?
Yes - I pass on the worst (or at least let people know the public release dates if not the details).
A
There's not much we really can do to prepare since we're unlikely to have anything to backport. The work to backport to the stable release will already be done for anything important enough to go through an embargo. A restriction on disclosure for 7 days just means we'll get the fix 7 days later.
The important issue here is that there needs to be enough interest in security by developers and trusted users to prioritize these package upgrades even if it's not a package they maintain, because the maintainer might not be around.