Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5987

Re: replacing misleading debian.org/security claims

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Tue, 2021-12-28 at 19:46 +0100, max wrote:

> Debian's security updates are created by volunteers working in their
> spare time. Some packages may receive more attention than others. To
> view the current list of known unfixed vulnerabilities see
> https://security-tracker.debian.org/tracker/status/release/stable

This isn't entirely factual either. The LTS team is mostly composed of
people being paid to contribute, with some volunteers. Some of the
stable security team may also be paid, but there isn't any public
information about who is paid and who they work for.

https://wiki.debian.org/LTS/Team
https://wiki.debian.org/LTS/Funding

I suggest contacting the stable and LTS security teams to draft a
statement that best represents the current and future reality of Debian
security updates.

https://www.debian.org/security/faq#contact
https://wiki.debian.org/LTS#Get_in_contact
https://wiki.debian.org/LTS/Contact

> (Side note: It seems that NVD tends to assign "medium" severity to
> vulnerabilities initially, but upgrades them to "high" or "critical"
> later. However, Debian keeps showing the initial severity rating)

Please send a patch, issue or mail about that separately.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2021-12-30 10:10 +0100
  Re: replacing misleading debian.org/security claims Silas Cutler <Silas@BlackLab.io> - 2021-12-30 17:20 +0100
    Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
  Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
    Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-10 01:50 +0100
    Incorrect NVD severity ratings: (was: replacing misleading  debian.org/security claims) max  <maxwillb@mailfence.com> - 2022-01-10 02:00 +0100
    Re: replacing misleading debian.org/security claims Salvatore Bonaccorso <carnil@debian.org> - 2022-01-10 06:40 +0100
      Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-14 00:40 +0100
        Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-14 23:50 +0100
          Re: replacing misleading debian.org/security claims Robert Ricardo Ikaka <ikaka.robert.online@gmail.com> - 2022-01-15 04:30 +0100
          Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-18 05:50 +0100
            Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-18 23:40 +0100
              Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-20 23:00 +0100
                Re: replacing misleading debian.org/security claims RP <reyadmin@gmail.com> - 2022-01-21 02:20 +0100
                Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-21 12:00 +0100

csiph-web