Re: replacing misleading debian.org/security claims

From	max <maxwillb@mailfence.com>
Newsgroups	linux.debian.security
Subject	Re: replacing misleading debian.org/security claims
Date	2022-01-14 00:40 +0100
Message-ID	<DFhRf-6CP-3@gated-at.bofh.it> (permalink)
References	<DzZBF-2LF-19@gated-at.bofh.it> <DC7Y5-7cX-1@gated-at.bofh.it> <DDVzs-1D2-11@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

January 10, 2022 6:31:37 AM CET Salvatore Bonaccorso <carnil@debian.org> wrote:

> We are going to stop anyway at some point displaying the NVD severity, for context see #992115.

As I see it, Debian should be free to display or not display NVD ratings, but it shouldn't display the incorrect "medium" NVD ratings, when they are actually much worse, as it's been doing. In fact, I think it should issue a public retraction.

Any progress on my original proposal? Are the wheels in motion?

https://lists.debian.org/debian-security/2021/12/msg00002.html
https://lists.debian.org/debian-security/2022/01/msg00002.html

I can't help but feel that it's a 15 second job for anyone with write access to the site, and the reprehensibility of the current claims should be obvious to those with a working moral compass.

-- 
Sent with https://mailfence.com  
Secure and private email

Thread

replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2021-12-30 10:10 +0100
  Re: replacing misleading debian.org/security claims Silas Cutler <Silas@BlackLab.io> - 2021-12-30 17:20 +0100
    Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
  Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
    Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-10 01:50 +0100
    Incorrect NVD severity ratings: (was: replacing misleading  debian.org/security claims) max  <maxwillb@mailfence.com> - 2022-01-10 02:00 +0100
    Re: replacing misleading debian.org/security claims Salvatore Bonaccorso <carnil@debian.org> - 2022-01-10 06:40 +0100
      Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-14 00:40 +0100
        Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-14 23:50 +0100
          Re: replacing misleading debian.org/security claims Robert Ricardo Ikaka <ikaka.robert.online@gmail.com> - 2022-01-15 04:30 +0100
          Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-18 05:50 +0100
            Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-18 23:40 +0100
              Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-20 23:00 +0100
                Re: replacing misleading debian.org/security claims RP <reyadmin@gmail.com> - 2022-01-21 02:20 +0100
                Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-21 12:00 +0100

csiph-web