Distribution packages considered insecure

Re:Distribution packages considered insecure by reidrac on Monday February 22, 2016 @04:32AM (#11149620)

Related to open source, you probably want to track OSS Security mailing list [1]; or if you're part of an organization relying on open source software, you should have someone looking at that list.

I think it is a good complement to the security advisories of your Linux distributor (Debian, CentOS, whatever), but is isn't free as you'll need time to keep an eye on it.

1: http://oss-security.openwall.org/

[ Parent | on HN ]

Re:Distribution packages considered insecure by mbrock on Monday February 22, 2016 @04:46AM (#11149676)

Thanks. Regarding cost... someone should sell curated security feeds to startups.

There must be many dozens of engineers who monitor mailing lists for issues in (let's say) ElasticSearch. They could be incentivized to share their findings.

Then if one source tags a certain CVE as significant, I get a ping. If several sources tag it, the ping gets more urgent. Eventually I feel scared enough that I upgrade.

[ Parent | on HN ]

Re:Distribution packages considered insecure by tie_ on Monday February 22, 2016 @06:33AM (#11150099)

There was something made to ease exactly that pain... sadly it's no longer updated: http://www.websecuritywatch.com/

[ Parent | on HN ]