I wish following BUGTRAQ was a 'damn good idea', but currently I don't see the point in doing so.
From my point of view (sysadm) this s**cks.
Anyone remember an advisory about Wu-FTPD six months ago. IIRC Redhat published there advisory as soon as they had a fix, and the other distributors and CERT(?) accused Redhat of not following the rules regarding how advisories should be published.
I am not interested in the upgraded package, I want to know when someone find a exploitable security bug.
If there is a security bug in some vital piece of software, like apache or ssh, maybe the right thing to do is shut the service down. But since we want be telled that the bug exist until RedHat/Mdk/Caldera etc etc etc all have updated package, we have production system with exploitable holes.
Regarding the Perlmonks code: Doesn't the Perlmonks community hold all the best perl hackers on the planet?
If the code could not stand the audit from it's own community, then maybe it's time to throw old things out, do it all over again and do it right (Flame, flame :) )