[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: svn commit: r1339559 - /subversion/site/publish/docs/release-notes/release-history.html

From: Daniel Shahaf <d.s_at_daniel.shahaf.name>
Date: Thu, 17 May 2012 21:02:59 +0300

Hyrum K Wright wrote on Thu, May 17, 2012 at 12:59:23 -0500:
> I'lll also point out that in the past downstream users have made the
> determination for us, and requested their own CVEs for issues in our
> releases. I don't think that's a problem, and we can't really control
> how downstream judges the impact of a particular issue, but it just
> feels nice if we handle the CVE process for our own issues.
>

CVE are meant to be a unique identifier to an issue so I think it's
a (minor?) problem if different downstreamers requests CVE's
independently.

> In the past CVE almost exclusively meant an embargo and
> pre-notification and the rest of the circus that implies. I think
> there is some middle ground here where we request a CVE, but then just
> treat the release in a standard way, just mentioning the CVE in
> CHANGES or the release announcement.
>
> It might also be nice to look at how other projects handle this stuff.
> Are they as aggressive about labeling things "security-related" and
> getting CVEs as we are?

IOW, "Should we be trigger-happy or conservative on requesting CVE
identifiers?".

I think that's a good question; perhaps we should ask it security@.
Received on 2012-05-17 20:03:38 CEST

This is an archived mail posted to the Subversion Dev mailing list.