Re: [yocto] Renaming the yocto-security mailing list

I've updated [email protected] to require
moderator approval for new topics. This should prevent private
security reports from being posted publicly by mistake.
[email protected] is not a private list but instead forwards
email received to members of the security team.

I believe this solves the issue without requiring changes to the list
name or documentation.

On Tue, Aug 19, 2025 at 2:50 PM Rudolf J Streif via
lists.yoctoproject.org
<[email protected]> wrote:
>
> I don't any specifics about the incident. I suppose security-relevant
> information was submitted to a public mailing list. A private mailing
> list may help but in the end it's security-by-obfuscation. A mailing
> list for submitting CVEs is not the best choice imho. A secure web form
> should be better. We have a CVE Status page
> (https://wiki.yoctoproject.org/wiki/CVE_Status) that lists the current
> acknowledged CVEs but of course reported CVEs should go through an
> investigative filter and potentially sanitizing first before put on that
> page.
>
> :rjs
>
> On 8/19/25 8:08 AM, Marta Rybczynska via lists.yoctoproject.org wrote:
> > Hello all,
> > yesterday's incident confirms that yocto-security has a confusing name
> > that might cause confidential reports to arrive there.
> >
> > What about renaming the list to yocto-security-discussion or similar?
> > And eventually redirect yocto-security to the private security list.
> >
> > My reasoning: we shouldn't rename the private list as people might use
> > old versions of documentation and we want them to address the correct
> > private list when needed. It is less critical if a message expected
> > for the public list reaches the private one, than otherwise.
> >
> > What do you think? What is the process to do the change?
> >
> > Kind regards,
> > Marta
> >
> >
> >
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#65771): https://lists.yoctoproject.org/g/yocto/message/65771
> Mute This Topic: https://lists.yoctoproject.org/mt/114782606/1003190
> Group Owner: [email protected]
> Unsubscribe: https://lists.yoctoproject.org/g/yocto/unsub [[email protected]]
> -=-=-=-=-=-=-=-=-=-=-=-
>


-- 
Michael Halstead
Linux Foundation / Yocto Project
Systems Operations Engineer