Re: oCERT

[Florian Weimer <fw@deneb.enyo.de>]

* Yves-Alexis Perez:

> would it make sense for Debian to participate to http://www.ocert.org
> (Opensource Computer Emergency Response Team)?
>
> It could be nice to share advisories and that sort of things.

Debian is already a member of vendor-sec, a well-established group for
handling embargoed issues and background discussions related to free
software.  Personally, I don't see the need for yet another
vulnerability sharing club, especially since Ocert seems to insist on
Ocert <-> vendor communication (or maybe it's even Ocert <-> individual,
hard to tell at this stage), as opposed to vendor <-> vendor
communication under the vendor-sec model.  This means that when, we find
a bug in an upstream patch, Ocert needs to relay that information to all
involved vendors, and forward further questions back to us.  Apart from
the delay, this suffers from the dreaded Chinese Whispers syndrome.

(Speaking only for myself, and not for the security team.)