All of lore.kernel.org
 help / color / mirror / Atom feed
From: George Dunlap <George.Dunlap@eu.citrix.com>
To: Jan Beulich <JBeulich@suse.com>
Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>,
	Lars Kurth <lars.kurth@xen.org>, Matt Wilson <msw@amazon.com>,
	"xen-devel@lists.xen.org" <xen-devel@lists.xen.org>
Subject: Re: Security vulnerability process, and CVE-2012-0217
Date: Wed, 4 Jul 2012 13:56:09 +0100	[thread overview]
Message-ID: <CAFLBxZY=DS6mQWCLr9xB6HicbHmzdSuvvMwWagb+KbwnDPF0=w@mail.gmail.com> (raw)
In-Reply-To: <4FF45896020000780008DA4C@nat28.tlf.novell.com>

On Wed, Jul 4, 2012 at 1:52 PM, Jan Beulich <JBeulich@suse.com> wrote:
> Being on the list doesn't make you non-susceptible. Such an
> approach, imo, would need to imply permission to anyone on
> the list to deploy a fix as soon as it is available. But since
> distros can't ship binaries without also making sources available,
> that's a contradiction by itself.

Yes, preventing vendors from shipping until the public disclosure date
would discriminates against "vendor-supplied" users in favor of
"self-supplied" users (i.e., those who download and build their own
directly from xen.org).

Would it work to say that vendors can ship to anyone on the list?  In
theory that could work, but in practice I think most distros would
rather just release once and be done with it, rather than dealing with
a 2-stage process.

 -George

  reply	other threads:[~2012-07-04 12:56 UTC|newest]

Thread overview: 56+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-06-19 18:16 Security vulnerability process, and CVE-2012-0217 Ian Jackson
2012-06-20  8:49 ` Jan Beulich
2012-06-20  9:45   ` George Dunlap
2012-06-20 10:32     ` Jan Beulich
2012-07-02 13:59       ` Ian Campbell
2012-07-02 14:58         ` Jan Beulich
2012-07-02 15:04           ` Ian Campbell
2012-07-02 15:17         ` Alan Cox
2012-07-02 15:20           ` Ian Campbell
2012-06-28 18:30   ` Alan Cox
2012-07-04  9:27     ` Ian Campbell
2012-07-04 10:04       ` John Haxby
2012-06-29 10:26   ` George Dunlap
2012-06-29 10:41     ` Jan Beulich
2012-07-02 14:00   ` Ian Campbell
2012-06-23 19:42 ` Matt Wilson
2012-06-28 17:45   ` George Dunlap
2012-07-02 13:59     ` Ian Campbell
2012-06-27 18:07 ` Thomas Goirand
2012-06-27 19:14   ` Alan Cox
2012-06-27 19:30   ` Sander Eikelenboom
2012-06-28  9:28   ` Lars Kurth
2012-07-02 13:58     ` Ian Campbell
2012-07-02 14:51       ` Jan Beulich
2012-07-02 14:57         ` Ian Campbell
2012-07-03 22:03     ` Matt Wilson
2012-07-04 10:33       ` Ian Campbell
2012-07-04 11:24       ` Stefano Stabellini
2012-07-04 12:36         ` George Dunlap
2012-07-04 12:52           ` Jan Beulich
2012-07-04 12:56             ` George Dunlap [this message]
2012-07-04 13:01               ` Jan Beulich
2012-07-04 13:30               ` Stefano Stabellini
2012-07-04 14:09                 ` Jan Beulich
2012-07-04 15:09                   ` Stefano Stabellini
2012-07-06 14:36                     ` John Haxby
2012-07-06 16:39                 ` Matthew Allen
2012-07-06 17:24                   ` George Dunlap
2012-06-29 10:01   ` George Dunlap
2012-06-29 15:48     ` Thomas Goirand
2012-07-02 13:59     ` Ian Campbell
2012-07-02 15:13       ` Alan Cox
2012-07-03 11:12       ` George Dunlap
2012-07-03 14:18         ` Stefano Stabellini
2012-08-23 10:37 ` Ian Campbell
2012-08-23 10:37   ` [PATCH 1/6] Clarify what info predisclosure list members may share during an embargo Ian Campbell
2012-08-23 10:37   ` [PATCH 2/6] Clarifications to predisclosure list subscription instructions Ian Campbell
2012-08-23 10:37   ` [PATCH 3/6] Clarify the scope of the process to just the hypervisor project Ian Campbell
2012-08-23 10:37   ` [PATCH 4/6] Discuss post-embargo disclosure of potentially controversial private decisions Ian Campbell
2012-08-23 10:37   ` [PATCH 5/6] Patch review, expert advice and targetted fixes Ian Campbell
2012-08-23 10:37   ` [PATCH 6/6] Declare version 1.3 Ian Campbell
2012-09-24 11:25   ` Security vulnerability process, and CVE-2012-0217 [vote?] Lars Kurth
2012-10-01 16:38     ` Ian Jackson
2012-10-03 17:03       ` Lars Kurth
2012-10-04  8:39       ` Lars Kurth
2012-07-02 15:24 Security vulnerability process, and CVE-2012-0217 John Creol

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='CAFLBxZY=DS6mQWCLr9xB6HicbHmzdSuvvMwWagb+KbwnDPF0=w@mail.gmail.com' \
    --to=george.dunlap@eu.citrix.com \
    --cc=JBeulich@suse.com \
    --cc=lars.kurth@xen.org \
    --cc=msw@amazon.com \
    --cc=stefano.stabellini@eu.citrix.com \
    --cc=xen-devel@lists.xen.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.