Re: GNU C Library as its own CNA?

[Siddhesh Poyarekar <siddhesh@gotplt.org>]

On 2023-07-28 13:28, Paul Eggert wrote:
> On 2023-07-28 09:41, Joseph Myers wrote:
>> If we add some kind of private submission
>> mechanism, we should also strongly discourage its use for the bulk of
>> low-risk issues to avoid adding unnecessary overhead for those.
> 
> One possibility is to use an already-existing submission mechanism, 
> namely the GNU Security Escalation Contact <security@gnu.org>. For what 
> it's worth, that mailing list gets little email, mostly false alarms.
> 
> https://savannah.gnu.org/mail/?group=security

Or alternatively, a private mailing list on sourceware alongside other 
current lists.  One of the future challenges may be to support encrypted 
submissions since that seems to be a preference for some security 
researchers.  We could do that for now by just listing public keys of 
volunteers in the security group but if we end up with too many such 
submissions or have too many volunteers or otherwise have operational 
difficulties then we may have to think of another solution.

Thanks,
Sid