Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 25 Jun 2012 13:30:06 +0400
From: Solar Designer <>
Subject: Xen vulnerability disclosure process, recent timeline


Here's a surprisingly detailed posting on Xen's vulnerability disclosure
process and how the recent set of issues was handled (detailed timeline):

As always, this is all about tradeoffs, and many of the issues sound
very familiar - yet I appreciate this level of transparency.

Regarding Xen's "pre-disclosure list", are messages on it PGP-encrypted
to the recipients?  Perhaps this should be made a requirement and
mentioned at

It feels likely that in practice most leaks will be via means unaffected
by the use of encryption, yet using PGP encryption is worthwhile.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.