Creating an Open Alternative to Bugtraq?

mbogosian asks: "I am not a sysadmin, nor am I a security expert, but I appreciate those who are. In response to a recent story, I went out and registered two domain names: opentraq.org and opentraq.net. I am hereby throwing down the gauntlet: I am willing to have them resolve to DNS servers belonging to a group of volunteers who wish to start and maintain an Open alternative to security services like BugTraq and others offered at the SecurityFocus website without being encumbered by the OIS Security Vulnerability Reporting And Response Process. I will continue to pay the renewal fees for the names as long as someone wants to continue the the effort. After the project becomes established and is maintained by a reputable (i.e., non-commercial) group of volunteers, I am willing transfer ownership of the domains to that group at no cost. Feel free to contact me if you are interested. Let the discussion begin! " Do you feel such a thing is necessary at this time? Why or why not?

Comments

dude.

[Naikrovek]

uhh, dude, you should direct those efforts into fixing what's there, not creating something new, doubling the whole effort just because of one thing. Sure its a non-trivial thing, but I think it would be a lot easier to fix what's there than redoing the whole thing, just because some folks can't get their exploits in time to exploit others.

Re:dude.

[crotherm]

OK.. so how do you fix Security Focus' plan to snip the balls from bugtraq? Watching SF's change from a small site to a very corporate site, I wonder how long it would take for bugtraq to lose what made it the first mail list I read every morning.

IMO, having a open and non-corp backed mail list to handle security buq and the like would be the natural evolution needed to insure sysadmins have the most up to date info.

erm

[sydlexic]

let me get this straight, you ripped off an idea, spent $9 bucks on a domain and expect the real hard work to be done by a bunch of grateful volunteers. meanwhile, some dufus thought this was so amazing they posted the story on slashdot. great work all around people. if only it were really this easy.

Nice that someone is willing

[Coyote67]

I don't know about you guys but I don't think whether its necessary is important. Is there really a justifiable reason not to have an OSS community run bug tracking site? If you think about it, it can benefit a lot of people, and maybe even speed up patches/fixes/updates/whatever.
I'd also like to see something like this supported by major firms, maybe just by setting up a system where the community can easily communicate with firms regarding security and bug issues.

Bugtraq works just fine

[DeadSea]

The previous article you point to shows recommendations from a group of companies that argue that bug reports should not be made public. Bugtraq does not follow this recommendation, and I doubt that it ever will. Bugtraq fully discloses bugs to the general public and I don't see that changing any time soon.

The bug finding, reporting, fixing, and patching process should minimize the potential damage. If your goal is to minimize damage then neither full immediate discloser or no disclosure is a good answer. Bruce Schneier has written a good article about full disclosure in his Crypto-Gram newsletter.

Unless bugtraq is falling down on the job, why do we need another one?

Re:Bugtraq works just fine

[lpontiac]

The previous article you point to shows recommendations from a group of companies that argue that bug reports should not be made public. Bugtraq does not follow this recommendation, and I doubt that it ever will

"ever" is a strong word. Remember that one of the companies giving those recommendations is Symantec. Symantec own SecurityFocus. SecurityFocus runs Bugtraq.

Yet Another Try... *yawn*

[Hanashi]

This isn't a new idea. Various people or groups dissatisfied with Bugtraq have created their own alternative lists over the years. No one pays much attention to any of them. For a good example, check out BugDev.

I applaud your initiative, but honestly, I don't see either the need or the point.

Too Much

[truffle pig]

I Personally think that Bugtraq does a pretty good job already. The problem I see happening with having multiple lists such as the one being presented here is a case of information overload. All I can think about is having to sift through a series of duplicate vulnerabilities that people posted to both lists. It already takes me long enough some mornings to keep up with everything that has posted to Bugtraq overnight.

Knowing this I would say if you want to do something, make it a couple degrees more useful than Bugtraq. I think a more interactive forum would be nice. I see some value in being able to perform advanced searches for vulnerabilities and code samples, as well as more filtering capabilties on the mailing list to sort out vulnerabilities that are only relevant to your enviroment.

Just some thoughts, but my impression is that the person who submitted the story doesn't want to do any real work anyway so this is all probably a moot point.