From owner-freebsd-security  Mon Aug 27 16:27: 8 2001
Delivered-To: freebsd-security@freebsd.org
Received: from barry.mail.mindspring.net (barry.mail.mindspring.net [207.69.200.25])
	by hub.freebsd.org (Postfix) with ESMTP
	id 89BE037B401; Mon, 27 Aug 2001 16:27:05 -0700 (PDT)
	(envelope-from meshko@polkan2.dyndns.org)
Received: from user-2ivef38.dsl.mindspring.com (user-2ivef38.dsl.mindspring.com [165.247.60.104])
	by barry.mail.mindspring.net (8.9.3/8.8.5) with ESMTP id TAA14905;
	Mon, 27 Aug 2001 19:27:01 -0400 (EDT)
Date: Mon, 27 Aug 2001 19:27:59 -0400 (EDT)
From: Mikhail Kruk <meshko@polkan2.dyndns.org>
X-X-Sender:  <meshko@localhost>
To: Igor Roshchin <str@giganda.komkon.org>
Cc: "Jacques A. Vidrine" <n@nectar.com>,
	<freebsd-security@FreeBSD.ORG>, <security-officer@FreeBSD.ORG>
Subject: Re: procmail, squid: any takers?
In-Reply-To: <200108272048.f7RKm5k67160@giganda.komkon.org>
Message-ID: <Pine.BSF.4.33.0108271922360.45703-100000@localhost>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

> The main point is that with the trust of the FreeBSD users to the
> FreeBSD core-team and security-officer(s) in particular,
> developed over the years of great work of FreeBSD team,
> people rely [well, maybe sometimes somewhat reluctantly] on the
> FreeBSD advisories, and their timely appearance.

I think anyone who follows advisories for some time knows that they do not
go out immediately after a problem is discovered and usually it even takes
some time after the problem is fixed. I realize that Security Team is
doing what it can, but I think that everyone who subscribes to the list
should be notified that they should not rely on the list as the main
source of security information.

Another possibility (which of course was discussed many times here) is to
release informal warnings on the list as soon as a bug is patched and then
take as long as needed to release formal advisory... I guess it's not a
an acceptable solution for some reason.


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message