Date: Tue, 10 Mar 2015 09:41:22 +0000 From: John Haxby <john.haxby@...cle.com> To: oss-security@...ts.openwall.com Subject: Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 09/03/15 20:39, Kurt Seifried wrote: > I find this really hard to believe based on the past. So you're > saying Oracle is willing to work with Red Hat and the community in > general now? Can we get access to the MySQL security bugs and test > cases for example? This would be HUGELY helpful to the community. I have no link to MySQL. You need to take this up with those people. > > I'll believe Oracle is willing to work with the community when I > actually see Oracle participate and help the community. Until then > it's just words from some random Oracle employee and most likely > isn't official policy. > > So prove to us you want to work with us (e.g. by opening up the > MySQL security bugs/test cases) and we can definitely look at > future cooperation. I would really like to be able to do that, but this is a political problem outside my control. We, the linux team, already contribute not inconsiderable amounts to the community: we're a big contributor to xen, to parts of the linux kernel including btrfs, ocfs2 (obviously), nfs ... the MAINTAINERS file lists 13 maintainers with @oracle.com maintainers. It wouldn't take a lot of searching to find our contributions to numerous other projects. None of this, however, has anything to do with the matter at hand. If no one from Red Hat is unwilling to cooperate in getting a single backward-compatible resolution to incorporating PEP-466 into the distro python versions then perhaps someone else is. If there's interest, I'll gladly work with anyone who wants to find a way to do this. This is just me trying, as usual, to do the best by everyone. I don't speak for Oracle, I'm not paid enough for that, I'm just trying to make sure that we don't wind up with a backported fix that makes the overall situation worse. So can we please set aside the anti-corporate sentiments? jch -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iF4EAREIAAYFAlT+vDYACgkQRQu7fpQvo8iCJAD/fE7RhFUrNTJkvxkaBBidQvG4 m3VLzug74/zMt/oQFbEA/A2ykhF8V3Cnbvt23OvczCpJOOxr/d9cB0M9m+IvpZtA =mKaH -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ