Gentoo Linux Security AffiliationsThe Gentoo Linux Security Team is dedicated to an open development process and supports responsible disclosure. This means we closely collaborate with software upstreams, other distributions, security researchers and CERTs to ensure the security of our distribution. Our group affiliations allow us to access vulnerability information and receive notifications as early as possible. As participants in a coordinated release process, we are able to assess vulnerabilities before they publicly known. We work with Gentoo developers, upstream and other distributions to prepare updates that reach Gentoo users as soon as the vulnerability is public. We commit ourselves to publish all our own findings, but we respect if third parties decide to keep certain information private. Members and contributors of the Security team should review this list before attempting to become part of a mailing list. Any such requests are to be discussed internally and acknowledged by a team lead first. Gentoo is part of the distros and linux-distros mailing list. The mailing list discusses vulnerabilities in several free software products and is often used for coordinated disclosure. Current members: a3li, craig Gentoo is a member of oCERT ever since its incarnation in 2008. The Open Source Computer Emergency Response Team is an effort to assist free software projects in vulnerability management and usually performs responsible disclosure. We are proud to say that three of the five oCERT founding team members are former Gentoo developers. Gentoo is a listed vendor with the CERT Coordination Center (CERT/CC). We receive general vulnerability notifications through the most widely known CERT. Current members: a3li, keytoaster Gentoo is part of the WebKit Security mailing list and bugzilla group since 2009. This group discusses vulnerabilities in products based on the WebKit web browsing engine, such as WebKit-GTK, Qt 4 and Google Chrome. Current members: a3li, keytoaster Gentoo is seeking membership of the Mozilla Security Group. Current members: none. Gentoo is part of the OpenOffice.org Security Group. Current members: a3li, suka. Gentoo is subscribed to the samba-pkg-sec mailing list where advance Samba announcements are distributed. Gentoo is a member of the oss-security mailing list since it was founded in 2008. It is a public discussion channel targeted towards security flaws in free software. Gentoo is committed to the Common Vulnerabilities and Exposures project that seeks to enumerate information vulnerabilities. We automatically monitor the CVE feed for vulnerabilities and are seeking for our GLSAs and Bugzilla channels to output CVE identifiers. We are seeking CVE-Compatible status in the near future. Gentoo is using vulnerability feeds provided by Secunia in order to improve vulnerability assessment and workflow automation. The contents of this document, unless otherwise expressly stated, are licensed under the CC-BY-SA-2.5 license. The Gentoo Name and Logo Usage Guidelines apply. |
|