Re: [Full-disclosure] Open Letter on the Interpretation of "Vulnerability Statistics"

[Florian Weimer <fw@xxxxxxxxxxxxx>]

* Matt Zimmerman:

>> Yes, this puzzles me too, but on the other hand, Debian became a CNA,
>> and Debian's official policy is geared away from "responsible
>> disclosure" -- all bug reports are supposed to be public.
>
> Debian isn't a CNA; as far as I know, it isn't possible for
> organizations to become CNAs.

<http://cve.mitre.org/cve/cna.html#cnas> lists organizations, not
individuals.  The requirements are clearly geared towards
organizations, too.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/