Re: Policy for posting security bug reports?

[Mike Frysinger <vapier at gentoo dot org>]

On Monday 25 June 2012 16:08:14 Carlos O'Donell wrote:
> On 6/25/2012 4:05 PM, Russ Allbery wrote:
> > Carlos O'Donell <carlos_odonell@mentor.com> writes:
> >> * Contact the distribution contact listed on the MAINTAINERS
> >> 
> >>   page for every distribution affected by the issue.
> > 
> > A lot of packages that deal with a lot of security issues have a private
> > mailing list that's used by the maintainers to reach all of those people
> > at once.  (Some of them even do it via GnuPG-encrypted mail.)  I don't
> > know if GNU libc has enough security bug reports to warrant doing
> > something like that.
> 
> One easy point of contact is the newly appointed release manager
> for the branch currently in development. That person could then pull
> in the appropriate people.

we've got bugzilla set up.  it has support for restricting to people, and 
labeling things as security related (so it won't generate plain text e-mails 
with details).  if we "just" had https running on the system, we'd have all 
the pieces in a system that we've already been driving people to use.
-mike

Attachment: signature.asc
Description: This is a digitally signed message part.