Discussion on oss-sec about a centralized pre-disclosure list for cloud providers
A participant on the oss-sec list describes the pre-disclosure processes of virtualization projects and questions whether a centralized list makes sense for cloud computing providers, unless shared components are used by many providers.
The discussion was published on October 4, 2026 on the public oss-sec list, according to the machine-translated feed record that serves as the source. The message states that the Xen Project keeps its own pre-disclosure list, that KVM follows the Linux kernel security process, and that Cloud Hypervisor and QEMU have their own processes. The author says they do not know how Firecracker handles the matter.
Based on these points, the author questions whether a centralized list is needed for cloud providers. They concede it could make sense only if there are individual components used by many providers that fall outside the categories mentioned. The text does not present a decision, formal proposal or group conclusion.
To consult the original, open the public oss-sec list in its 2026 fourth-quarter archive and locate the message from October 4. Verify the date, author and content directly in the archive, since this summary relies on machine translation.