Date: Thu, 11 May 2023 07:36:44 -0400 From: Marc Deslauriers <marc.deslauriers@...onical.com> To: oss-security@...ts.openwall.com Subject: Clarification on embargoed testing in a partner cloud Hi, The Ubuntu security team shares and obtains information about embargoed issues from the distros and linux-distros mailing lists. One of our large cloud partners has asked the Ubuntu security team to do automated testing of embargoed security updates on their public cloud before the CRD. While technically we would not be directly sharing details of embargoed issues with them as the tests will be run under accounts owned by the Ubuntu security team, they will be run on their infrastructure. As such, this may hinder our ability to conduct a comprehensive internal investigation of any leak that may occur. I’m not exactly sure how this scenario fits within the policy of these lists, and would like to validate before we go ahead. ( Policy can be found here: https://oss-security.openwall.org/wiki/mailing-lists/distros ) Would testing embargoed updates obtained from the distros and linux-distros lists on an external cloud infrastructure violate the terms of those mailing lists? Would testing embargoed updates on an external cloud infrastructure be contrary to the expectations of the vendors posting embargoed issues to those lists? Thanks, Marc. -- Marc Deslauriers Ubuntu Security Engineer | http://www.ubuntu.com/ Canonical Ltd. | http://www.canonical.com/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.