All of lore.kernel.org
 help / color / mirror / Atom feed
From: John Haxby <john.haxby@oracle.com>
To: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Cc: George Dunlap <George.Dunlap@eu.citrix.com>,
	Lars Kurth <lars.kurth@xen.org>, Matt Wilson <msw@amazon.com>,
	Jan Beulich <JBeulich@suse.com>,
	"xen-devel@lists.xen.org" <xen-devel@lists.xen.org>
Subject: Re: Security vulnerability process, and CVE-2012-0217
Date: Fri, 06 Jul 2012 15:36:59 +0100	[thread overview]
Message-ID: <4FF6F80B.7040703@oracle.com> (raw)
In-Reply-To: <alpine.DEB.2.02.1207041602360.31911@kaball.uk.xensource.com>

On 04/07/12 16:09, Stefano Stabellini wrote:
>>> > > In practice, given the terms of the GPL, we cannot restrict anybody on
>>> > > the list from releasing the source of the fix before the embargo ends.
>> > 
>> > Of course. It's an agreement between the list members to not
>> > disclose anything.
> Yes, but an agreement that cannot be legally enforced.

I don't see that that is an issue.

Taking linux-distros as an example, an embargo date cannot be enforced
as there is no legal framework in which to enforce it.   Everyone
involved agrees to respect the embargo dates.   If an individual or
organisation repeatedly flaunted the embargo dates they would likely
find themselves removed from the list although, to my knowledge, this
has not happened.

For the list to work, the members need to cooperate: it is in their own
interest to cooperate, legal frameworks aren't required.

jch

  reply	other threads:[~2012-07-06 14:36 UTC|newest]

Thread overview: 56+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-06-19 18:16 Security vulnerability process, and CVE-2012-0217 Ian Jackson
2012-06-20  8:49 ` Jan Beulich
2012-06-20  9:45   ` George Dunlap
2012-06-20 10:32     ` Jan Beulich
2012-07-02 13:59       ` Ian Campbell
2012-07-02 14:58         ` Jan Beulich
2012-07-02 15:04           ` Ian Campbell
2012-07-02 15:17         ` Alan Cox
2012-07-02 15:20           ` Ian Campbell
2012-06-28 18:30   ` Alan Cox
2012-07-04  9:27     ` Ian Campbell
2012-07-04 10:04       ` John Haxby
2012-06-29 10:26   ` George Dunlap
2012-06-29 10:41     ` Jan Beulich
2012-07-02 14:00   ` Ian Campbell
2012-06-23 19:42 ` Matt Wilson
2012-06-28 17:45   ` George Dunlap
2012-07-02 13:59     ` Ian Campbell
2012-06-27 18:07 ` Thomas Goirand
2012-06-27 19:14   ` Alan Cox
2012-06-27 19:30   ` Sander Eikelenboom
2012-06-28  9:28   ` Lars Kurth
2012-07-02 13:58     ` Ian Campbell
2012-07-02 14:51       ` Jan Beulich
2012-07-02 14:57         ` Ian Campbell
2012-07-03 22:03     ` Matt Wilson
2012-07-04 10:33       ` Ian Campbell
2012-07-04 11:24       ` Stefano Stabellini
2012-07-04 12:36         ` George Dunlap
2012-07-04 12:52           ` Jan Beulich
2012-07-04 12:56             ` George Dunlap
2012-07-04 13:01               ` Jan Beulich
2012-07-04 13:30               ` Stefano Stabellini
2012-07-04 14:09                 ` Jan Beulich
2012-07-04 15:09                   ` Stefano Stabellini
2012-07-06 14:36                     ` John Haxby [this message]
2012-07-06 16:39                 ` Matthew Allen
2012-07-06 17:24                   ` George Dunlap
2012-06-29 10:01   ` George Dunlap
2012-06-29 15:48     ` Thomas Goirand
2012-07-02 13:59     ` Ian Campbell
2012-07-02 15:13       ` Alan Cox
2012-07-03 11:12       ` George Dunlap
2012-07-03 14:18         ` Stefano Stabellini
2012-08-23 10:37 ` Ian Campbell
2012-08-23 10:37   ` [PATCH 1/6] Clarify what info predisclosure list members may share during an embargo Ian Campbell
2012-08-23 10:37   ` [PATCH 2/6] Clarifications to predisclosure list subscription instructions Ian Campbell
2012-08-23 10:37   ` [PATCH 3/6] Clarify the scope of the process to just the hypervisor project Ian Campbell
2012-08-23 10:37   ` [PATCH 4/6] Discuss post-embargo disclosure of potentially controversial private decisions Ian Campbell
2012-08-23 10:37   ` [PATCH 5/6] Patch review, expert advice and targetted fixes Ian Campbell
2012-08-23 10:37   ` [PATCH 6/6] Declare version 1.3 Ian Campbell
2012-09-24 11:25   ` Security vulnerability process, and CVE-2012-0217 [vote?] Lars Kurth
2012-10-01 16:38     ` Ian Jackson
2012-10-03 17:03       ` Lars Kurth
2012-10-04  8:39       ` Lars Kurth
2012-07-02 15:24 Security vulnerability process, and CVE-2012-0217 John Creol

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4FF6F80B.7040703@oracle.com \
    --to=john.haxby@oracle.com \
    --cc=George.Dunlap@eu.citrix.com \
    --cc=JBeulich@suse.com \
    --cc=lars.kurth@xen.org \
    --cc=msw@amazon.com \
    --cc=stefano.stabellini@eu.citrix.com \
    --cc=xen-devel@lists.xen.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.