Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <17f7ebb7-22ee-e68f-02ac-8e2740e7f015@canonical.com>
Date: Thu, 11 May 2023 07:36:44 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Clarification on embargoed testing in a partner cloud

Hi,

The Ubuntu security team shares and obtains information about embargoed issues 
from the distros and linux-distros mailing lists.

One of our large cloud partners has asked the Ubuntu security team to do 
automated testing of embargoed security updates on their public cloud before the 
CRD. While technically we would not be directly sharing details of embargoed 
issues with them as the tests will be run under accounts owned by the Ubuntu 
security team, they will be run on their infrastructure. As such, this may 
hinder our ability to conduct a comprehensive internal investigation of any leak 
that may occur.

I’m not exactly sure how this scenario fits within the policy of these lists, 
and would like to validate before we go ahead. ( Policy can be found here: 
https://oss-security.openwall.org/wiki/mailing-lists/distros )

Would testing embargoed updates obtained from the distros and linux-distros 
lists on an external cloud infrastructure violate the terms of those mailing 
lists? Would testing embargoed updates on an external cloud infrastructure be 
contrary to the expectations of the vendors posting embargoed issues to those lists?

Thanks,

Marc.

-- 
Marc Deslauriers
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.