Date: Thu, 29 Apr 2021 06:27:48 -0600 (MDT)
From: Ariadne Conill <ariadne@dereferenced.org>
To: Konstantin Kulikov <k.kulikov2@gmail.com>
cc: ~alpine/devel@lists.alpinelinux.org
Subject: Re: A shared vulnerability format for open-source packages
In-Reply-To: <CAD+eXGQuPB7jOPZgOAkEoNiwZvWmi8CGVqrqgxXijW-rPo=RJw@mail.gmail.com>
Message-ID: <309a2660-f22-4a97-2ad5-305f41ba744@dereferenced.org>
References: <CAD+eXGQuPB7jOPZgOAkEoNiwZvWmi8CGVqrqgxXijW-rPo=RJw@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII; format=flowed

Hello,

On Thu, 29 Apr 2021, Konstantin Kulikov wrote:

> Russ Cox of Go language team has drafted a proposal for a shared
> vulnerability format for open-source packages with goals to enhance
> interoperability between language teams, security researchers, and
> cross-language databases.
> See google doc [0] and his original tweet [1].

I have responded to him on Twitter.  We have been talking about a similar 
idea in ##distro-security on freenode.  It looks to me like both concepts 
are complimentary to each other (we are talking about federating security 
data between internal distro trackers, using JSON-LD and Linked Data 
Notifications), as Russ's proposal provides a reasonable vocabulary for 
the security data to use.

Maybe we can get everyone together in ##distro-security to talk about this 
and organize something?

Ariadne