Date: Tue, 19 Feb 2008 20:26:06 +0300 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: Re: FAQ for upstream maintainers On Mon, Feb 18, 2008 at 11:57:27AM -0900, Jonathan Smith wrote: > Since my main goal (I understand if your goals differ, but they > certainly should not conflict) for this list is to provide a way for > upstream to coordinate with the vendors, I'm going to start a FAQ or > tutorial or whatever dedicated to what upstream should do when they get > a report from a user about a security issue. > > Basic rough draft: > http://oss-security.openwall.org/wiki/whattodo > > I'm sure it can use some cleanup... Ideas, submissions, etc welcome! I've just applied many minor edits to this page, as well as two important changes: 1. Added the text "... and promptly notify your users of the availability and importance of this new release." This will need to be made more verbose later on - perhaps it deserves its own paragraph (what communication channels may or should exist, etc.) 2. Replaced the suggestion to "... publish it during the embargo with no mention of any security-related impact" with a paragraph that allows such an action if it is absolutely necessary, but discourages it. > Also quite welcome would be someone with wiki-fu prettying up the page :-) Well, that does not apply to me, so I've only fixed the mailing lists link to be an internal one so far. We could also want to rename this web page to something containing the likely search keywords - and possibly move it to a namespace, which would give a keyword too, once we have a suitable one. "whattodo" is not a likely keyword (or not a closely relevant one). Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.