[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4F198D50.5090705@redhat.com>
Date: Fri, 20 Jan 2012 08:50:40 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Solar Designer <solar@...nwall.com>
Subject: Re: distros & linux-distros embargo period and message
format
On 01/20/2012 02:44 AM, Solar Designer wrote:
> Hi,
>
> I've just updated the wiki page at:
>
> http://oss-security.openwall.org/wiki/mailing-lists/distros
>
> to state the following:
>
> "Please note that the maximum acceptable embargo period for issues
> disclosed to these lists is 14 to 19 days, with embargoes longer than 14
> days (up to 19) allowed in case the issue is reported on a Thursday or a
> Friday and the proposed coordinated disclosure date is thus adjusted to
> fall on a Monday or (preferably) a Tuesday. Please do not ask for a
> longer embargo. In fact, embargoes shorter than 14 days are preferable."
>
> Previously, the maximum was specified as 14 days unconditionally, but
> frankly this started to fail in practice for the day-of-week reason -
> so I've adjusted the policy as above (based on proposals from list
> members).
>
> While at it, I've also added this clarification on the format of messages:
>
> "Speaking of encryption, the supported message formats are: plain
> unencrypted messages, PGP/MIME (including with attachments), or inline
> PGP. (In all of these cases, messages are distributed to list members
> (re-)encrypted to their own keys.) However, manual PGP-encrypted
> attachments are not supported (so if you want to attach file(s) to your
> encrypted message, use PGP/MIME)."
>
> Alexander
Why not just make it 10 business days with a note to be kind with
respect to holidays (i.e. over the Xmas break for us North/South
Americans and Europeans). Agreed for the message format. Might want to
add a list of tools/etc. that do pgp/mime so there is less of an excuse
to do it improperly.
--
-- Kurt Seifried / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
