Is there any way to subscribe to Moodle's "securityalerts" mailing list for email addresses other than the one my site is registered with? That the registration address can be the only address subscribed to the security list seems kind of... well, dumb.
I can't imagine that I'm the only one whose site's public contact person is not the person in charge of security. Furthermore, as I would expect is common with any large site, my server administration is done by more than just a single tech and all of them should receive the security announcements.
I can sympathize with the desire to keep a bit of a lid on security announements, but making it so complicated to receive those announements even for the people they are intended for just kind of seems like security-by-obscurity rather than real security.
The public security announcements are here:
http://moodle.org/security
The private security announcements on the securityalerts mailing list are just to give registered Moodle sites some advance notice. It's one of the perks of registering the site. (Currently it has over 35,000 people on it).
When registering the site (or re-registering the site), you do get the opportunity to enter any email address you like there. You can thus point it to some local mailing list address or a simple mail alias that can redirect it to all the people you want.
Cheers
http://moodle.org/security
The private security announcements on the securityalerts mailing list are just to give registered Moodle sites some advance notice. It's one of the perks of registering the site. (Currently it has over 35,000 people on it).
When registering the site (or re-registering the site), you do get the opportunity to enter any email address you like there. You can thus point it to some local mailing list address or a simple mail alias that can redirect it to all the people you want.
Cheers
In reply to Martin Dougiamas
Re: How to subscribe to securityalerts mailing list?
by Iñaki Arenaza -
If I use a local mailing list, then that is the address that gets used as the public contact in the moodle.org/sites directory. It's looking like I will just have to change the registration so that "contact from the public" is disabled.
I really wish the public contact and the securityalerts mailing list could be directed to different addresses.
I really wish the public contact and the securityalerts mailing list could be directed to different addresses.