Vulnerability embargo dates

* Vulnerability embargo dates - add your public holidays
@ 2017-05-10 13:38 Ian Jackson
  2017-05-10 13:51 ` Juergen Gross
  0 siblings, 1 reply; 7+ messages in thread
From: Ian Jackson @ 2017-05-10 13:38 UTC (permalink / raw)
  To: xen-announce, xen-devel, xen-users; +Cc: security-team-members

When the Xen Project Security Team talks to discoverers about choice
of release dates for security vulnerabilities, we generally try to
avoid known public holidays (subject to other constraints such as the
discoverer's requirements, the Xen Project policy, and so on).

We wish to make this arrangement a bit more formal, and in particular
to provide discoverers (who ultimately decide disclosure dates) and
the Security Team (who often give advice) with good information to
support their decisions.

To this end we have created a wiki page where interested community
members can document public holidays which would affect their ability
to respond to security issues.

Please see:
  https://wiki.xenproject.org/wiki/HolidayCalendar

If you would like your circumstances taken into account, please add to
the data for 2017 on that page.

Note that if you do not already have write access to the wiki, you'll
have to request it.  Sorry for the inconvenience, and please see:
  https://wiki.xenproject.org/wiki/Main_Page

Also, as the HolidayCalendar wiki page says:

  Note that disclosure schedules are determined by the discoverers of
  vulnerabilities who do not need to follow the guidelines in the Xen
  Project policy.  Where discoverers ask the Xen Project Security Team
  for advice, or choose to follow the policy, the holiday information
  here is advisory only.  Because the policy requires us to consider
  other factors too, we cannot guarantee to avoid holidays.

Ian.

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel

^ permalink raw reply	[flat|nested] 7+ messages in thread