Date: Wed, 21 Jun 2017 07:35:34 -0500 From: Josh Bressers <josh@...ss.net> To: oss-security@...ts.openwall.com Subject: Re: Qualys Security Advisory - The Stack Clash On Mon, Jun 19, 2017 at 3:39 PM, Solar Designer <solar@...nwall.com> wrote: > > > That said, we owe apologies to the community for violating the published > distros list policy regarding the maximum embargo duration. Personally > and as distros list admin, I do apologize for letting this happen. > > I think we shouldn't have let it happen. > > I suspect the extended embargo was exactly correct in this instance. Having a policy you follow no matter what isn't ideal either (in fact it's probably dangerous). We've all been through a lot of embargoes, two weeks is more than acceptable for most of them, it's a very good thing to have a forcing function when needed. This one was special, nobody can deny that. It was big, complex, and amazing. It ticked all the boxes. It affected a substantial portion of the Internet. Had a name. Is a very old bug. Was very serious. Had a great advisory and organization behind it. Yet nobody flipped out. It was unexciting. I suspect it was all so smooth because on Monday because everyone was ready, everyone knew what was going on. There was no rushing, nothing was on fire. There was time to develop patches properly. Everyone had their story straight. It's quite likely if you force a release in two weeks because that's the rule, someone not ready would create a story where one shouldn't exist. I applaud everyone involved. I'm sure there were issues, but I doubt such a large effort could have gone better. Rules such as this exist to guide us, don't let them constrain us. -- JB
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ