replacing misleading debian.org/security claims

From	max <maxwillb@mailfence.com>
Newsgroups	linux.debian.security
Subject	replacing misleading debian.org/security claims
Date	2021-12-30 10:10 +0100
Message-ID	<DzZBF-2LF-19@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Some statements on debian.org/security are inaccurate, and many people are misled by them.

I propose replacing

"""
Debian takes security very seriously. We handle all security problems brought to our attention and ensure that they are corrected within a reasonable timeframe.
"""

with something more factual, like

"""
Debian's security updates are created by volunteers working in their spare time. Some packages may receive more attention than others. To view the current list of known unfixed vulnerabilities see https://security-tracker.debian.org/tracker/status/release/stable
"""

(Side note: It seems that NVD tends to assign "medium" severity to vulnerabilities initially, but upgrades them to "high" or "critical" later. However, Debian keeps showing the initial severity rating)

-- 
Sent with https://mailfence.com  
Secure and private email

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2021-12-30 10:10 +0100
  Re: replacing misleading debian.org/security claims Silas Cutler <Silas@BlackLab.io> - 2021-12-30 17:20 +0100
    Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
  Re: replacing misleading debian.org/security claims Paul Wise <pabs@debian.org> - 2022-01-05 07:30 +0100
    Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-10 01:50 +0100
    Incorrect NVD severity ratings: (was: replacing misleading  debian.org/security claims) max  <maxwillb@mailfence.com> - 2022-01-10 02:00 +0100
    Re: replacing misleading debian.org/security claims Salvatore Bonaccorso <carnil@debian.org> - 2022-01-10 06:40 +0100
      Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-14 00:40 +0100
        Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-14 23:50 +0100
          Re: replacing misleading debian.org/security claims Robert Ricardo Ikaka <ikaka.robert.online@gmail.com> - 2022-01-15 04:30 +0100
          Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-18 05:50 +0100
            Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-18 23:40 +0100
              Re: replacing misleading debian.org/security claims max  <maxwillb@mailfence.com> - 2022-01-20 23:00 +0100
                Re: replacing misleading debian.org/security claims RP <reyadmin@gmail.com> - 2022-01-21 02:20 +0100
                Re: replacing misleading debian.org/security claims Pierre-Elliott Bécue <peb@debian.org> - 2022-01-21 12:00 +0100

csiph-web