This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] Re: Security vulnerability process - last call

To: Eugene Teo <eugene@xxxxxxxxxx>
Subject: Re: [Xen-devel] Re: Security vulnerability process - last call
From: Ian Campbell <Ian.Campbell@xxxxxxxxxx>
Date: Wed, 20 Jul 2011 10:23:06 +0100
Cc: "xen-devel@xxxxxxxxxxxxxxxxxxx" <xen-devel@xxxxxxxxxxxxxxxxxxx>
Delivery-date: Wed, 20 Jul 2011 02:26:39 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <loom.20110720T071054-985@xxxxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Organization: Citrix Systems, Inc.
References: <19998.52380.356516.189861@xxxxxxxxxxxxxxxxxxxxxxxx> <loom.20110720T071054-985@xxxxxxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
FYI Ian J is travelling and will be back online (at least partially,
depending on connectivity at debconf) probably on Monday.

On Wed, 2011-07-20 at 06:39 +0100, Eugene Teo wrote:
> Ian Jackson <Ian.Jackson <at> eu.citrix.com> writes:
> > 3. Advisory public release:
> > 
> >    At the embargo date we will publish the advisory, and push
> >    bugfix changesets to public revision control trees.
> Perhaps be a bit more specific. At which timezone will the advisory be 
> published? For the folks in Asia Pacific, this could mean a public pre-
> disclosure of about 12 hours or more if security (at) xen is based in the 
> States.

The embargo date/time will be precise and include timezone information.

security@ is mostly based in the UK but since the embargo date is
subject to negotiation with the discoverer it is possible that the
advisory will be published during daylight hours in some other timezone.


Xen-devel mailing list

<Prev in Thread] Current Thread [Next in Thread>