Leo Famulari <l...@famulari.name> writes:
> I think that several of us are subscribed to oss-security as part of our
> effort to learn about upstream security issues in a timely manner.
>
> A couple days ago, MITRE decided to stop assigning CVEs from the list:
>
> http://seclists.org/oss-sec/2017/q1/351
>
> So, I expect that we will see fewer bugs sent to oss-security, and Guix
> developers interested in package security may need to adjust their
> approach to learning about such bugs.
>
> Let's share some tips on where to find this information.
>
> I look at the lwn.net security advisories, the Debian security-announce
> mailing list, `guix lint -c cve`, the upstream bug trackers of a handful
> of packages, and even some Twitter personalities.
>
> What about you?
I’m not sure if this is sufficient but it looks like new CVEs are also
listed here:
https://cassandra.cerias.purdue.edu/CVE_changes/today.html
The added CVEs can also be viewed per day or month.
There’s also an RSS feed:
https://nvd.nist.gov/download/nvd-rss.xml
A disadvantage (but also a blessing) is that there’s a lot of software
in the feed that we don’t have in Guix. I would be happy if we had a
system to give us more *relevant* warnings. (Running “guix lint -c cve”
regularly and shooting off notifications…?)
--
Ricardo
GPG: BCA6 89B6 3655 3801 C3C6 2150 197A 5888 235F ACAC
https://elephly.net
