Re: Policy for posting security bug reports?

[Mike Frysinger <vapier at gentoo dot org>]

On Saturday 23 June 2012 09:55:51 Petr Baudis wrote:
> On Fri, Jun 22, 2012 at 09:08:36PM -0400, Rich Felker wrote:
> > I first asked Carlos about this off-list, and he suggested it should
> > be discussed on-list. What is the policy (or what should it be) for
> > posting security-related bugs to the bug tracker and/or list?
> 
>   I'd like to ask people familiar what other GNU projects, what is the
> policy there? E.g. for gcc, binutils (probably not too many security
> bugs in these two), coreutils, ...?

gcc & binutils pretty explicitly don't have security paths.  bugs are bugs to 
them.  probably because it's fairly easy to crash them, and they don't get run 
in the same situations as the C library.
-mike

Attachment: signature.asc
Description: This is a digitally signed message part.