Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5985

Re: replacing misleading debian.org/security claims

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi Max -

(First time poster (?Maybe) / long time lurker).

I think highlighting that Debian is supported by volunteers is important 
and providing up front a link to tracker is outstanding.  The "we take 
security seriously" text is dated consistent with standard boiler-plate 
text.

I'd also like to see information on both how to submit vulnerabilities 
as well as how to contribute to getting them fixed.

Thanks,
Silas




On 12/28/21 1:46 PM, max wrote:
> Some statements on debian.org/security are inaccurate, and many people are misled by them.
> 
> I propose replacing
> 
> """
> Debian takes security very seriously. We handle all security problems brought to our attention and ensure that they are corrected within a reasonable timeframe.
> """
> 
> with something more factual, like
> 
> """
> Debian's security updates are created by volunteers working in their spare time. Some packages may receive more attention than others. To view the current list of known unfixed vulnerabilities see https://security-tracker.debian.org/tracker/status/release/stable
> """
> 
> (Side note: It seems that NVD tends to assign "medium" severity to vulnerabilities initially, but upgrades them to "high" or "critical" later. However, Debian keeps showing the initial severity rating)
> 

-- 
Silas Cutler (Silas@BlackLab.io)
PGP Fingerprint (598A 812E FB8C BA19 69A5 D17A C14D A520 A02E 8CD6)

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2021-12-30 10:10 +0100
  Re: replacing misleading debian.org/security claims Silas Cutler <Silas@BlackLab.io> - 2021-12-30 17:20 +0100
    Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
  Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
    Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-10 01:50 +0100
    Incorrect NVD severity ratings: (was: replacing misleading  debian.org/security claims) max  <maxwillb@mailfence.com> - 2022-01-10 02:00 +0100
    Re: replacing misleading debian.org/security claims Salvatore Bonaccorso <carnil@debian.org> - 2022-01-10 06:40 +0100
      Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-14 00:40 +0100
        Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-14 23:50 +0100
          Re: replacing misleading debian.org/security claims Robert Ricardo Ikaka <ikaka.robert.online@gmail.com> - 2022-01-15 04:30 +0100
          Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-18 05:50 +0100
            Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-18 23:40 +0100
              Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-20 23:00 +0100
                Re: replacing misleading debian.org/security claims RP <reyadmin@gmail.com> - 2022-01-21 02:20 +0100
                Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-21 12:00 +0100

csiph-web