Policy for posting security bug reports?

[Carlos O'Donell]

On 6/27/2012 10:23 PM, Mike Frysinger wrote:
> On Monday 25 June 2012 16:08:14 Carlos O'Donell wrote:
>> On 6/25/2012 4:05 PM, Russ Allbery wrote:
>>> Carlos O'Donell <carlos_odonell@mentor.com> writes:
>>>> * Contact the distribution contact listed on the MAINTAINERS
>>>>
>>>>   page for every distribution affected by the issue.
>>>
>>> A lot of packages that deal with a lot of security issues have a private
>>> mailing list that's used by the maintainers to reach all of those people
>>> at once.  (Some of them even do it via GnuPG-encrypted mail.)  I don't
>>> know if GNU libc has enough security bug reports to warrant doing
>>> something like that.
>>
>> One easy point of contact is the newly appointed release manager
>> for the branch currently in development. That person could then pull
>> in the appropriate people.
> 
> we've got bugzilla set up.  it has support for restricting to people, and 
> labeling things as security related (so it won't generate plain text e-mails 
> with details).  if we "just" had https running on the system, we'd have all 
> the pieces in a system that we've already been driving people to use.
> -mike

Is there anything preventing us from getting https support?

Can't we just turn that on in apache and it just works?

If all we need is https, could you email overseers and see if we can turn it on?

Cheers,
Carlos.
-- 
Carlos O'Donell
Mentor Graphics / CodeSourcery
carlos_odonell@mentor.com
carlos@codesourcery.com
+1 (613) 963 1026