Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
oss-security contributors propose digests or a separate list to manage a flood of AI vulnerability reports.
On the oss-security list, Rihards Simanovics supported a proposal to add a dedicated vulnerability-reports mailing list amid what the thread calls an AI vulnpocalypse. He argued the approach should extend beyond Apache and that any project posting more than two or three advisories in a day should send one digest. Those digests would link to NVD, GHSA, and the project's own advisory pages so the main list stays readable.
- Reply supports a separate oss-security list for vulnerability reports.
- Suggests extending daily advisory digests beyond Apache.
- Digests would link NVD, GHSA, and project advisory pages.
From the original article
Posted by Rihards Simanovics on Oct 17 Agree with Peter, and I'd suggest extending this beyond Apache. Any project sending say more than two or three advisories in a day could consolidate them into a single digest, with links to the relevant entries in the usual vulnerability databases (NVD, GHSA, the project's own advisory pages, etc).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.