[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAKoP-y-NnHqx=87K+m_6UibGG3jzFcGNzU=3Y5o52FVLJ75m-g@mail.gmail.com>
Date: Wed, 21 Jun 2017 07:35:34 -0500
From: Josh Bressers <josh@...ss.net>
To: oss-security@...ts.openwall.com
Subject: Re: Qualys Security Advisory - The Stack Clash
On Mon, Jun 19, 2017 at 3:39 PM, Solar Designer <solar@...nwall.com> wrote:
>
>
> That said, we owe apologies to the community for violating the published
> distros list policy regarding the maximum embargo duration. Personally
> and as distros list admin, I do apologize for letting this happen.
>
> I think we shouldn't have let it happen.
>
>
I suspect the extended embargo was exactly correct in this instance. Having
a policy you follow no matter what isn't ideal either (in fact it's
probably dangerous).
We've all been through a lot of embargoes, two weeks is more than
acceptable for most of them, it's a very good thing to have a forcing
function when needed. This one was special, nobody can deny that. It was
big, complex, and amazing. It ticked all the boxes. It affected a
substantial portion of the Internet. Had a name. Is a very old bug. Was
very serious. Had a great advisory and organization behind it.
Yet nobody flipped out. It was unexciting.
I suspect it was all so smooth because on Monday because everyone was
ready, everyone knew what was going on. There was no rushing, nothing was
on fire. There was time to develop patches properly. Everyone had their
story straight. It's quite likely if you force a release in two weeks
because that's the rule, someone not ready would create a story where one
shouldn't exist.
I applaud everyone involved. I'm sure there were issues, but I doubt such a
large effort could have gone better. Rules such as this exist to guide us,
don't let them constrain us.
--
JB
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
