[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 11 May 2023 07:36:44 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Clarification on embargoed testing in a partner cloud
Hi,
The Ubuntu security team shares and obtains information about embargoed issues
from the distros and linux-distros mailing lists.
One of our large cloud partners has asked the Ubuntu security team to do
automated testing of embargoed security updates on their public cloud before the
CRD. While technically we would not be directly sharing details of embargoed
issues with them as the tests will be run under accounts owned by the Ubuntu
security team, they will be run on their infrastructure. As such, this may
hinder our ability to conduct a comprehensive internal investigation of any leak
that may occur.
I’m not exactly sure how this scenario fits within the policy of these lists,
and would like to validate before we go ahead. ( Policy can be found here:
https://oss-security.openwall.org/wiki/mailing-lists/distros )
Would testing embargoed updates obtained from the distros and linux-distros
lists on an external cloud infrastructure violate the terms of those mailing
lists? Would testing embargoed updates on an external cloud infrastructure be
contrary to the expectations of the vendors posting embargoed issues to those lists?
Thanks,
Marc.
--
Marc Deslauriers
Ubuntu Security Engineer | http://www.ubuntu.com/
Canonical Ltd. | http://www.canonical.com/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
