All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Jan Beulich" <JBeulich@suse.com>
To: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: George Dunlap <George.Dunlap@eu.citrix.com>,
	Lars Kurth <lars.kurth@xen.org>, Matt Wilson <msw@amazon.com>,
	"xen-devel@lists.xen.org" <xen-devel@lists.xen.org>
Subject: Re: Security vulnerability process, and CVE-2012-0217
Date: Wed, 04 Jul 2012 15:09:45 +0100	[thread overview]
Message-ID: <4FF46AC9020000780008DAFD@nat28.tlf.novell.com> (raw)
In-Reply-To: <alpine.DEB.2.02.1207041424420.31911@kaball.uk.xensource.com>

>>> On 04.07.12 at 15:30, Stefano Stabellini <stefano.stabellini@eu.citrix.com> wrote:
> Can we just avoid all this and use the security list to communicate that
> a fix is going to be available on a particular hour of a particular day?
> This way all the software vendors and service providers can ready
> themselves to deploy it as soon as they can.
> The fix would be released to the security list and xen-devel at the same
> time.

That would only call for each party trying to create and deliver
their fix themselves and up front. You'd then also have to hide
the issue description. Which would render the security list
redundant.

> In practice, given the terms of the GPL, we cannot restrict anybody on
> the list from releasing the source of the fix before the embargo ends.

Of course. It's an agreement between the list members to not
disclose anything.

Jan

  reply	other threads:[~2012-07-04 14:09 UTC|newest]

Thread overview: 56+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-06-19 18:16 Security vulnerability process, and CVE-2012-0217 Ian Jackson
2012-06-20  8:49 ` Jan Beulich
2012-06-20  9:45   ` George Dunlap
2012-06-20 10:32     ` Jan Beulich
2012-07-02 13:59       ` Ian Campbell
2012-07-02 14:58         ` Jan Beulich
2012-07-02 15:04           ` Ian Campbell
2012-07-02 15:17         ` Alan Cox
2012-07-02 15:20           ` Ian Campbell
2012-06-28 18:30   ` Alan Cox
2012-07-04  9:27     ` Ian Campbell
2012-07-04 10:04       ` John Haxby
2012-06-29 10:26   ` George Dunlap
2012-06-29 10:41     ` Jan Beulich
2012-07-02 14:00   ` Ian Campbell
2012-06-23 19:42 ` Matt Wilson
2012-06-28 17:45   ` George Dunlap
2012-07-02 13:59     ` Ian Campbell
2012-06-27 18:07 ` Thomas Goirand
2012-06-27 19:14   ` Alan Cox
2012-06-27 19:30   ` Sander Eikelenboom
2012-06-28  9:28   ` Lars Kurth
2012-07-02 13:58     ` Ian Campbell
2012-07-02 14:51       ` Jan Beulich
2012-07-02 14:57         ` Ian Campbell
2012-07-03 22:03     ` Matt Wilson
2012-07-04 10:33       ` Ian Campbell
2012-07-04 11:24       ` Stefano Stabellini
2012-07-04 12:36         ` George Dunlap
2012-07-04 12:52           ` Jan Beulich
2012-07-04 12:56             ` George Dunlap
2012-07-04 13:01               ` Jan Beulich
2012-07-04 13:30               ` Stefano Stabellini
2012-07-04 14:09                 ` Jan Beulich [this message]
2012-07-04 15:09                   ` Stefano Stabellini
2012-07-06 14:36                     ` John Haxby
2012-07-06 16:39                 ` Matthew Allen
2012-07-06 17:24                   ` George Dunlap
2012-06-29 10:01   ` George Dunlap
2012-06-29 15:48     ` Thomas Goirand
2012-07-02 13:59     ` Ian Campbell
2012-07-02 15:13       ` Alan Cox
2012-07-03 11:12       ` George Dunlap
2012-07-03 14:18         ` Stefano Stabellini
2012-08-23 10:37 ` Ian Campbell
2012-08-23 10:37   ` [PATCH 1/6] Clarify what info predisclosure list members may share during an embargo Ian Campbell
2012-08-23 10:37   ` [PATCH 2/6] Clarifications to predisclosure list subscription instructions Ian Campbell
2012-08-23 10:37   ` [PATCH 3/6] Clarify the scope of the process to just the hypervisor project Ian Campbell
2012-08-23 10:37   ` [PATCH 4/6] Discuss post-embargo disclosure of potentially controversial private decisions Ian Campbell
2012-08-23 10:37   ` [PATCH 5/6] Patch review, expert advice and targetted fixes Ian Campbell
2012-08-23 10:37   ` [PATCH 6/6] Declare version 1.3 Ian Campbell
2012-09-24 11:25   ` Security vulnerability process, and CVE-2012-0217 [vote?] Lars Kurth
2012-10-01 16:38     ` Ian Jackson
2012-10-03 17:03       ` Lars Kurth
2012-10-04  8:39       ` Lars Kurth
2012-07-02 15:24 Security vulnerability process, and CVE-2012-0217 John Creol

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4FF46AC9020000780008DAFD@nat28.tlf.novell.com \
    --to=jbeulich@suse.com \
    --cc=George.Dunlap@eu.citrix.com \
    --cc=lars.kurth@xen.org \
    --cc=msw@amazon.com \
    --cc=stefano.stabellini@eu.citrix.com \
    --cc=xen-devel@lists.xen.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.