Policy for posting security bug reports?

[Mike Frysinger]

On Monday 25 June 2012 16:08:14 Carlos O'Donell wrote:
> On 6/25/2012 4:05 PM, Russ Allbery wrote:
> > Carlos O'Donell <carlos_odonell@mentor.com> writes:
> >> * Contact the distribution contact listed on the MAINTAINERS
> >> 
> >>   page for every distribution affected by the issue.
> > 
> > A lot of packages that deal with a lot of security issues have a private
> > mailing list that's used by the maintainers to reach all of those people
> > at once.  (Some of them even do it via GnuPG-encrypted mail.)  I don't
> > know if GNU libc has enough security bug reports to warrant doing
> > something like that.
> 
> One easy point of contact is the newly appointed release manager
> for the branch currently in development. That person could then pull
> in the appropriate people.

we've got bugzilla set up.  it has support for restricting to people, and 
labeling things as security related (so it won't generate plain text e-mails 
with details).  if we "just" had https running on the system, we'd have all 
the pieces in a system that we've already been driving people to use.
-mike
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <http://sourceware.org/pipermail/libc-alpha/attachments/20120628/0dfc6183/attachment.sig>