[VIM] Joomla! developer: Being "The Vendor" for Security Issues

[security curmudgeon]

late response..

On Sun, 6 Sep 2009, Steven M. Christey wrote:

: This is basically a commentary on typical VDB practices shared by most 
: of us.  The Joomla!  folks have a couple solid points, especially on 
: proper distinction of third-party extensions from core, and their desire 
: for accuracy.
: 
: http://community.joomla.org/blogs/community/1029-on-being-qthe-vendorq.html
: 
: I'm thinking on a constructive response.  The apparent practice of 
: removing vulnerable extensions from their directory is probably 
: adversely affecting all of us - certainly CVE, who tries to verify that 
: an extension is not just site-specific before we create an entry.

I noticed this kind of issue pretty early on and directed how OSVDB 
handles it. Since our data set isn't 50% complete, vendor information is 
not added for many entries. As a result, the only real and consistant 
distinction we can make is in the title.

This goes for Joomla! and any other software with third-party plugins.

Vendor:
Joomla! ...

Third-party:
X Plugin for Joomla! ..

It's subtle but the best we can do for now.