Key points
- Monthly accepted messages ranged from 319 to 400 between June and September.
- Subscriber numbers decreased as more users left than joined.
- Approval of multi-message disclosures is now delayed until single-message queue items are processed.
The oss-security mailing list has updated its moderation process. Solar Designer announced on October 16 that multi-message disclosures are now held back. This change ensures that single-message reports currently waiting in the queue are approved first. The adjustment addresses operational challenges related to the volume of security disclosures posted to the list.
In plain English
Security researchers use this list to share details about vulnerabilities. The administrator recently changed how new posts are handled. Instead of approving all submissions immediately, the system now prioritizes shorter, single-message reports. Longer disclosures that span multiple messages must wait. This rule applies only to messages that are already in the moderation queue. The goal is to manage the flow of information more effectively.
The background
From June through September, the list accepted between 319 and 400 messages each month. This volume remained stable during those four months. However, the number of people subscribed to the list began to drop. More subscribers were leaving than new users were joining. The administrator noted that this churn rate is significantly higher than it was before the rise of AI-generated content. This trend prompted a review of the list's management procedures.
What changes now
The primary change affects how multi-message disclosures are processed. Solar Designer stated that approval for these longer posts is now delayed. The delay continues until single-message disclosures already in the queue are reviewed. This procedural shift does not change the total number of accepted messages. It only alters the order in which moderators approve pending submissions. The list continues to operate within its recent volume ranges.
Who needs to act first
Teams monitoring this list should review their subscription settings. Ensure that automated tools can handle delayed delivery times for multi-message posts. Verify that your team manually checks the archive for any missed reports during the transition. Adjust alerting rules to account for the new processing order. Do not assume immediate delivery for complex disclosures. Prioritize reviewing single-message alerts first, as they are now processed ahead of longer threads.
What to do and how to stay safe: oss-security
- Review your current subscription settings for the oss-security list.
- Ensure your filtering tools account for delayed multi-message approvals.
- Manually check the public archive for any missed disclosures.
- Update internal monitoring alerts to reflect the new processing order.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many messages does the list accept monthly?
The list accepted between 319 and 400 messages per month from June through September.
Why is the subscriber count decreasing?
More people are leaving the list than joining, creating churn higher than before AI.
What is the new moderation rule?
Approval of multi-message disclosures is delayed until single-message queue items are processed.
