Hello,
The other week, I sent a notice to fedora-legacy-list and fedora- security-list regarding the Macromedia Flash critical vulnerability (CVE-2006-0024, http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0024) thinking that, even though it is proprietary and therefore Fedora Core, Legacy, & Extras do not distribute it nor provide any support for it, that I could tell my friends on both lists about it, since this bug has the alleged possibility to run abitrary code remotely and so is critical.
Here's the post: http://www.redhat.com/archives/fedora-legacy-list/2006-March/msg00107.html
Some reservations were expressed to me privately about using our mailing list(s) to broadcast such information, after I already sent the thing out. Yet I sent it out, because I felt it would be important for folks who don't get Red Hat Enterprise Linux's security errata to be aware of the issue so they can protect their computers.
Perhaps this needs more discussion, however. As participating members of the Fedora Project team, are there things we should not say on the mailing list(s)? I keep reading things about the wiki, for example, that say we mustn't talk (at least on Fedora's official web-pages) about things that aren't "pure" open-source or that violate some standard of open- sourciness; nor should we use the wiki resource to point to outside resources that may have (Linux) software that is proprietary or use features that in some of many jurisdictions might violate patents or other intellectual property laws.
If that is so (and it's unclear to me exactly what those boundaries should be), it is unclear to me whether the instance of the buggy Flash player is one of those "no-nos" to talk about on Fedora mailing lists or wiki pages.
I would have liked to suggest that someone who is a member of <fedora-list@ redhat.com> make a post there about this issue like that which I posted to fedora-legacy-list and fedora-security-list, to help inform more of the Fedora community about this critical bug. But I am not sure now that sug- gesting or doing that is appropriate?
Can any of you offer any insight into this? Thank you.
Thanks and Regards, David Eisenstein
On Sat, 2006-04-01 at 13:06 -0600, David Eisenstein wrote:
Hello,
The other week, I sent a notice to fedora-legacy-list and fedora- security-list regarding the Macromedia Flash critical vulnerability (CVE-2006-0024, http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0024) thinking that, even though it is proprietary and therefore Fedora Core, Legacy, & Extras do not distribute it nor provide any support for it, that I could tell my friends on both lists about it, since this bug has the alleged possibility to run abitrary code remotely and so is critical.
Here's the post: http://www.redhat.com/archives/fedora-legacy-list/2006-March/msg00107.html
Some reservations were expressed to me privately about using our mailing list(s) to broadcast such information, after I already sent the thing out. Yet I sent it out, because I felt it would be important for folks who don't get Red Hat Enterprise Linux's security errata to be aware of the issue so they can protect their computers.
You are certainly allowed as a individual to post such warnings to the list. Just make it explicit that you are posting not on behalf of the project when it is controversial. Warren Togami for example made a announcement on the arrangement he had with Macromedia for a flash repository. That might be better suited for Fedora Legacy users too.
https://www.redhat.com/archives/fedora-announce-list/2006- March/msg00037.html
Perhaps this needs more discussion, however. As participating members of the Fedora Project team, are there things we should not say on the mailing list(s)?
I would say the usual netiquette guidelines such as generally being nice to each other apply but anything that doesnt fit the ideals of the project probably shouldnt be promoted in formal capacity.
For this kind of issues such as security vulnerabilities is something that we need to be responsible about even when we actually dont ship the applications or support them formally.
Rahul
Ps: No need to cc me. I am on this list as well now.
Am Sonntag, den 02.04.2006, 00:57 +0530 schrieb Rahul Sundaram:
On Sat, 2006-04-01 at 13:06 -0600, David Eisenstein wrote:
Hello,
The other week, I sent a notice to fedora-legacy-list and fedora- security-list regarding the Macromedia Flash critical vulnerability (CVE-2006-0024, http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0024) thinking that, even though it is proprietary and therefore Fedora Core, Legacy, & Extras do not distribute it nor provide any support for it, that I could tell my friends on both lists about it, since this bug has the alleged possibility to run abitrary code remotely and so is critical.
Here's the post: http://www.redhat.com/archives/fedora-legacy-list/2006-March/msg00107.html
Some reservations were expressed to me privately about using our mailing list(s) to broadcast such information, after I already sent the thing out. Yet I sent it out, because I felt it would be important for folks who don't get Red Hat Enterprise Linux's security errata to be aware of the issue so they can protect their computers.
You are certainly allowed as a individual to post such warnings to the list. Just make it explicit that you are posting not on behalf of the project when it is controversial. Warren Togami for example made a announcement on the arrangement he had with Macromedia for a flash repository.
That's would be my opinion, too.
Cu thl
On Sat, 2006-04-01 at 21:40 +0200, Thorsten Leemhuis wrote:
Am Sonntag, den 02.04.2006, 00:57 +0530 schrieb Rahul Sundaram:
You are certainly allowed as a individual to post such warnings to the list. Just make it explicit that you are posting not on behalf of the project when it is controversial. Warren Togami for example made a announcement on the arrangement he had with Macromedia for a flash repository.
That's would be my opinion, too.
Cu thl
I feel that we have a responsibility to inform our users when security is an issue even for items we do not provide that we are sure that a majority of our end users in that segment might have the item installed. I feel that flash would apply to the desktop segment of our target markets.
As for where these messages and how they are distributed is a bigger question. I feel they should be visible enough that the effected users will see the messages. Would posting a message about flash be right to a list of server administrators? I do not think so.
Is there a current web space that users can look for security issues that may apply to them? If not is this something that should be created and maintained by the community at large? If it does how can we promote this resource so users are aware can do research and can make wise choices?
On Sat, 2006-04-01 at 23:55 -0600, Robert 'Bob' Jensen wrote:
Is there a current web space that users can look for security issues that may apply to them? If not is this something that should be created and maintained by the community at large? If it does how can we promote this resource so users are aware can do research and can make wise choices?
Well, we get many security announcements to f-announce-l. It seems like an extra burden for us to track down and highlight security risks for applications not in Core or Extras; hard to know where to draw the line, and people are always going to think we drew it too far or not far enough.
It might be cool if we could get security announcements to all magically appear on a page ... or in a searchable database ... and that would cover us for everything in Core and Extras thoroughly. We could link to external lists of non-FC/FE vulnerabilities for packages in third-party repos.
FedoraNews.org and other news/planet sites might be a good place to draw attention to a vulnerability that is outside of the normal FC/FE-sphere but many users may have installed. For example, if there were a vulnerability in XMMS's MP3 plug-in, we would be remiss if no one announced it because it has the evil MP3 word in it.
- Karsten
On 4/3/06, Karsten Wade kwade@redhat.com wrote:
On Sat, 2006-04-01 at 23:55 -0600, Robert 'Bob' Jensen wrote:
Is there a current web space that users can look for security issues that may apply to them? If not is this something that should be created and maintained by the community at large? If it does how can we promote this resource so users are aware can do research and can make wise choices?
Well, we get many security announcements to f-announce-l. It seems like an extra burden for us to track down and highlight security risks for applications not in Core or Extras; hard to know where to draw the line, and people are always going to think we drew it too far or not far enough.
It might be cool if we could get security announcements to all magically appear on a page ... or in a searchable database ... and that would cover us for everything in Core and Extras thoroughly. We could link to external lists of non-FC/FE vulnerabilities for packages in third-party repos.
FedoraNews.org and other news/planet sites might be a good place to draw attention to a vulnerability that is outside of the normal FC/FE-sphere but many users may have installed. For example, if there were a vulnerability in XMMS's MP3 plug-in, we would be remiss if no one announced it because it has the evil MP3 word in it.
From time to time, I do post security information from third party
companies such as Adobe and Real on fedoranews.org. If you believe the information is critical for desktop computing environment, feel free to forward such security announcement and I'll add it under a new category which also generates rss feed. http://fedoranews.org/cms/Categories
Regards, -- Thomas Chung http://fedoraproject.org/wiki/ThomasChung
websites@lists.fedoraproject.org