Public SourceMage Discussion List

[Eric Sandall <eric AT sandall.us>]

Hello all,

In light of a recent and unintended discredit to the curl
developers/community[0] I would like to mention that anyone who does a 
security
update reported by someone other than the author's/developers or on the 
projects
mailing lists should check at the aforementioned locations before putting up
notices based on second-hand information.

It seems that the problem comes mainly from security reports only going to
security lists (e.g. BugTrac) and never reported to the developers of the
reported project (wget is another example listed in [0]).

Perhaps we should subscribe our sm-security AT sourcemage.org ML to every 
package's
security list (if they have a security-only list) mailing list? Somewhat like 
we
do sm-spell-submit.

This ends today's "In Other News" department. :)

-sandalle

[0] http://curl.haxx.se/mail/lib-2005-03/0108.html

--
Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.