End of life: 10/21/2024, Latest version: cos-101-17162-528-64
End of life: 10/21/2024, Latest version: cos-101-17162-528-64
End of life: 5/12/2026, Latest version: cos-113-18244-582-104
End of life: 5/12/2026, Latest version: cos-113-18244-582-104
End of life: 3/27/2024, Latest version: cos-97-16919-450-41
End of life: 3/27/2024, Latest version: cos-97-16919-450-41
End of life: 9/24/2025, Latest version: cos-109-17800-570-50
End of life: 9/24/2025, Latest version: cos-109-17800-570-50
End of life: 10/24/2023, Latest version: cos-93-16623-461-42
End of life: 10/24/2023, Latest version: cos-93-16623-461-42
End of life: 9/1/2022, Latest version: cos-85-13310-1498-13
End of life: 9/1/2022, Latest version: cos-85-13310-1498-13
End of life: 3/1/2023, Latest version: cos-89-16108-798-22
End of life: 3/1/2023, Latest version: cos-89-16108-798-22
End of life: 1/10/2022, Latest version: cos-81-12871-1317-8
End of life: 1/10/2022, Latest version: cos-81-12871-1317-8
End of life: 4/1/2021, Latest version: cos-77-12371-1109-0
End of life: 4/1/2021, Latest version: cos-77-12371-1109-0
End of life: 9/5/2020, Latest version: cos-73-11647-656-0
End of life: 9/5/2020, Latest version: cos-73-11647-656-0
End of life: 12/1/2019, Latest version: cos-69-10895-385-0
End of life: 12/1/2019, Latest version: cos-69-10895-385-0
End of life: 9/1/2026, Latest version: cos-117-18613-675-64
End of life: 9/1/2026, Latest version: cos-117-18613-675-64
End of life: 3/1/2027, Latest version: cos-121-18867-528-78
End of life: 9/1/2027, Latest version: cos-125-19216-532-135
End of life: 3/1/2028, Latest version: cos-129-19506-299-161
On 9/25/23 12:23, Solar Designer wrote: Administrative tasks mostly unrelated to (linux-)distros lists (but relevant to the wider community)
1. Help ensure that each message posted to oss-security contains the most essential information (e.g., vulnerability detail and/or exploit) directly in the message itself (and in plain text) rather than only by reference to an external resource, and add the missing information (e.g., in your own words, by quoting with proper attribution, and/or by creating and attaching a properly attributed text/plain export of a previously referenced web page) and remind the original sender of this requirement (for further occasions) in a "reply" posting when necessary - primary: Oracle Solaris, backup: Container-Optimized OS
2. Develop tools to help with the above (crawl URLs in messages and produce draft follow-ups for manual editing+posting)
3. Monitor for Open Source security issues/topics published elsewhere, identify which of these would fit, and bring them to oss-security
4. Develop tools to help with the above (automatically monitor Open Source projects' and other relevant third-party mailing lists, websites, social media, source code repositories, releases for likely Open Source security issues/topics)
5. Directly encourage upstreams, researchers, umbrella organizations, packagers, distros, etc. to report to the lists
6. Suggest and provide examples of quality improvements for such reports (beyond them containing the most essential information)
7. Set up and maintain more reliable oss-security Twitter/Mastodon feed(s) (the existing Twitter feed occasionally misses messages)
8. Set up and maintain new curated "best of oss-security" Twitter/Mastodon feed(s)
Out of these, items 1 and 3 existed before, and I see Alan Coopersmith from Oracle Solaris help with item 3 (thank you, Alan!), e.g.:
https://www.openwall.com/lists/oss-security/2023/07/27/1 https://www.openwall.com/lists/oss-security/2023/06/20/6 https://www.openwall.com/lists/oss-security/2023/04/12/4
but somehow not with item 1 - maybe it's some confusion, which we should correct? I don't recall Container-Optimized OS actually doing anything on item 1, where they're backup. Please correct me if I'm wrong (just didn't notice/recall something). Maybe we should free item 1 up for new volunteers now. Apologies, I may have misremembered exactly what I supposed to be doing at some point, and in hindsight, much of what I have done was closer to #6 than #1:
https://www.openwall.com/lists/oss-security/2022/01/25/15 https://www.openwall.com/lists/oss-security/2022/10/12/2 https://www.openwall.com/lists/oss-security/2023/01/31/7
but I at least did some of #1 if you look far enough back:
https://www.openwall.com/lists/oss-security/2022/08/09/1
I've also tried to set a good example in the messages I post on behalf of X.Org.
I'd be happy to pass on #1 to someone else and continue doing #3. I don't have the bandwidth to write tools to automate it though (#4) - I mostly monitor chatter on twitter & mastodon, watch the newly published CVE list, and monitor updates to https://salsa.debian.org/security-tracker-team/security-tracker.git.
-- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris