[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <54FEBC42.60104@oracle.com>
Date: Tue, 10 Mar 2015 09:41:22 +0000
From: John Haxby <john.haxby@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Another Python app (rhn-setup: rhnreg_ks) not
checking hostnames in certs properly CVE-2015-1777
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
On 09/03/15 20:39, Kurt Seifried wrote:
> I find this really hard to believe based on the past. So you're
> saying Oracle is willing to work with Red Hat and the community in
> general now? Can we get access to the MySQL security bugs and test
> cases for example? This would be HUGELY helpful to the community.
I have no link to MySQL. You need to take this up with those people.
>
> I'll believe Oracle is willing to work with the community when I
> actually see Oracle participate and help the community. Until then
> it's just words from some random Oracle employee and most likely
> isn't official policy.
>
> So prove to us you want to work with us (e.g. by opening up the
> MySQL security bugs/test cases) and we can definitely look at
> future cooperation.
I would really like to be able to do that, but this is a political
problem outside my control.
We, the linux team, already contribute not inconsiderable amounts to
the community: we're a big contributor to xen, to parts of the linux
kernel including btrfs, ocfs2 (obviously), nfs ... the MAINTAINERS
file lists 13 maintainers with @oracle.com maintainers. It wouldn't
take a lot of searching to find our contributions to numerous other
projects.
None of this, however, has anything to do with the matter at hand. If
no one from Red Hat is unwilling to cooperate in getting a single
backward-compatible resolution to incorporating PEP-466 into the
distro python versions then perhaps someone else is.
If there's interest, I'll gladly work with anyone who wants to find a
way to do this. This is just me trying, as usual, to do the best by
everyone. I don't speak for Oracle, I'm not paid enough for that, I'm
just trying to make sure that we don't wind up with a backported fix
that makes the overall situation worse.
So can we please set aside the anti-corporate sentiments?
jch
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iF4EAREIAAYFAlT+vDYACgkQRQu7fpQvo8iCJAD/fE7RhFUrNTJkvxkaBBidQvG4
m3VLzug74/zMt/oQFbEA/A2ykhF8V3Cnbvt23OvczCpJOOxr/d9cB0M9m+IvpZtA
=mKaH
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
