incubator-ooo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Rob Weir <>
Subject Re: [DISCUSS] Neutral / shared security list proposal
Date Fri, 21 Oct 2011 18:33:39 GMT
Please continue the detailed governance topic only on securityteam@OO.o.

Out of respect for the TDF guys, I don't want them to feel that the
only way they can have a say in the governance of securityteam is to
have a public discussion on the AOOo dev list.  I've seem previous
posts from TDF members, in other contexts, where they expressed
concerns about such things.

This will be the last post on this topic I will forward to ooo-dev.
And I'd caution others against forwarding material from a private
list, like securityteam, to a public list, like ooo-dev.  It is very
dangerous to cross post like this between public and private lists.
Let's stop that.  Now.


2011/10/21 Dennis E. Hamilton <>:
> OK, I am going ahead and including securityteam@OO.o in this discussion, then all of
us can see what's being discussed.
> I am adding the full text of what Michael was replying to as well.
> Simon proposes something more promising, from my viewpoint, beyond bilateral ownership
between AOOo and TDF.  He is looking for a multilateral solution using securityteam@ OO.o,
and this [DISCUSS] was started in response to Simon's proposal.
> There have been objections to this being only bilateral between AOOo and TDF.  A multilateral
approach is preferred for how the list conducts itself and how participants are able to ensure
coordination with their own private security operations when an issue of common concern comes
to light.
> Securityteam@ OO.o has a multilateral membership, I presume.  That was workable under
Sun and OASIS custodianship and there is no reason to assume that ASF (not AOOo) is not a
reliable custodian in that regard with regard to operational support, preserving security
of the list, dealing with outages, etc.  This is not about what happens on the list, but
fundamental IT operational support and the serious desire to ensure security and preservation
for the list and its archives.  ASF (not AOOo) has strong, enduring capabilities in that
regard.  It also manages an overall security@ operation and supports the various security
teams associated with individual Apache projects.
> Since ASF has been granted the domain name, the continuation of securityteam@ OO.o will
come under ASF infrastructure operation at some point, in some manner.  If the list can be
preserved using the already-known list address, that will be the least disruptive, operationally.
> How governance is dealt with on the list is independent of custodianship and has to be
worked out whoever hosts the list.  Commitment to multilateral governance is not a JFDI.
>  - Dennis
> -----Original Message-----
> From: Marc-André Laverdière []
> Sent: Friday, October 21, 2011 10:51
> To:
> Cc:;; 'lsecurity'; 'Simon Phipps'
> Subject: RE: [DISCUSS] Neutral / shared security list proposal
> I tend to go for the "just get it done" philosophy when we reach that point.
> So let me summarize what that'd mean for me:
> - Michael registers us a neutral mailing list and both teams register 3-4
> folks
> - We stick with the 'old' ml with the suggested membership structure.
> Like, seriously... just get it done ;)
>> Excuse me Michael, the proposal I am referring to was offered by Simon
>> Phipps
>> and I included his message.
>> If you don't want to accept the OUTLINE PROPOSAL or start from it as a
>> point
>> of discussion, that is fine.  Just be clear that Simon's proposal was the
>> one
>> that I was replying about and proposing be [DISCUSS]ed on ooo-dev too.
>> I was hoping that Simon's good offices in mediating this would be
>> valuable.
>> Is that not acceptable?
>> What I like about Simon's proposal is that it is the least disruptive, and
>> it
>> adds meritocracy and (private) transparency features to how
>> securityteam@OO.o
>> operates.  I assume that the current securityteam@ OO.o list would be
>> grandfathered in.  Why not?
>> I pointed out in starting this [DISCUSS] thread that there is enough
>> connection from ooo-security so that ASF can be represented well enough in
>> discussion on securityteam@ OO.o to forward Simon's proposal, if there is
>> agreement to do that.  I don't see where anything about myself, Rob, and
>> Caolan are in the message you are responding to.
>> With regard to how the list software works/might-not/doesn't, can these 2d
>> and
>> 3rd order issues be deferred until the big questions are handled?
>>  - Dennis
>> -----Original Message-----
>> From: Michael Meeks []
>> Sent: Friday, October 21, 2011 10:07
>> To:
>> Cc: 'Simon Phipps';; lsecurity
>> Subject: Re: [DISCUSS] Neutral / shared security list proposal
>> Hi Dennis & list,
>> On Fri, 2011-10-21 at 08:11 -0700, Dennis E. Hamilton wrote:
>>> It is not something that can be done unilaterally here on the AOOo
>>> podling.
>>> Do you propose that this be discussed at securityteam@ OO.o?  It would
>>> seem that is where consensus is required.
>>       Last I checked only a few from TDF's security group are on that list;
>> so it doesn't seem an ideal forum either. Lets just CC our security team
>> as I've done.
>>       I am mildly amused by the convenient deployment of the argument type:
>> "we have always done it this way" from a project undergoing such a lot
>> of (in many ways positive) changes. Combine this with a world of
>> extraordinary possibilities such as: mail forwarding and the "mail
>> address is well known" bites the dust. There were many projects and
>> people I used to admire in the ASF, but claiming it is neutral in
>> today's world is not sensible.
>>       I would like to see, and think it is reasonable to ask for:
>>       1. a neutral domain / list name
>>       2. a comprehensive set of moderators / admins cf. previous
>>       3. neutral hosting
>>       It seems vs. the present that the ASF guys are suggesting to compromise
>> on only one of these points (2.) ie. having two Apache supporters (Rob +
>> Dennis) as moderators, and one TDF guy (me or Caolan): is that right ?
>>       At a big stretch, assuming there is no heavy-governance-petting
>> anywhere near it, I could cope with not having 3. ie. Apache hosting it
>> - after all, that is rather invisible [ but I personally loathe reply-to
>> mangling - I don't believe we would want that pushed onto us ].
>>       So - where do we go from there ? it looks to me like no compromise is
>> possible (for some definitions of compromise). We could create two
>> 'neutral' mailing lists one at each side, with cross subscriptions to
>> our own security lists - but it all seems a bit pointless.
>>       Regards,
>>               Michael.
>> --
>>  <><, Pseudo Engineer, itinerant idiot
> -----Original Message-----
> From: Dennis E. Hamilton []
> Sent: Friday, October 21, 2011 08:11
> To: 'Simon Phipps'
> Cc: 'Michael Meeks';
> Subject: [DISCUSS] Neutral / shared security list proposal
> I'm not sure Simon noticed this.  Here's a follow-up, with a fresh thread.
> Simon, what is the next action on this proposal?  It is not something that can
> be done unilaterally here on the AOOo podling.  Do you propose that this be
> discussed at securityteam@ OO.o?  It would seem that is where consensus is
> required.
> AOOo ooo-security follows that list, as I described previously.  And there
> appear to be at least three of us from the AOOo PPMC that are individually
> subscribed.  So AOOo representation in the discussion can be assured.
> What's next?
>  - Dennis E. Hamilton
>   tools for document interoperability,  <>
>  gsm: +1-206-779-9430  @orcmid
> -----Original Message-----
> From: Dennis E. Hamilton []
> Sent: Wednesday, October 19, 2011 17:51
> To:;
> Cc: 'Michael Meeks'
> Subject: RE: Neutral / shared security list ...
> OK Simon, but I am talking about custodial responsibility too, not just the
> manner in which list administration and moderation are handled.
> I personally have no objection to the governance you propose in your second
> and third bullets.  I have no idea how it is done right now, since I am new to
> that list.  However ooo-security has been receiving mail from that list since
> 2011-10-13 and I have not seen any governance discussions, nor any indication
> of additions to the list in any way.
> It seems to me that your proposal should go to securityteam@ as well [;<).  I
> assume there are enough individuals there that are empowered to hammer this
> out.
> In that case, any intervention from ASF security@ observers of securityteam@
> would be if the house was on fire and from Apache Infra if the list was seen
> to be hacked or anything required immediate intervention, such as shutting
> down and restoring the list, anything else appropriate.  These are operational
> responsibilities that require someone with IT-operations level access to the
> equipment.
> Does that work better for you?
>  - Dennis
> -----Original Message-----
> From: Simon Phipps []
> Sent: Wednesday, October 19, 2011 16:19
> To:;
> Cc: Michael Meeks
> Subject: Re: Neutral / shared security list ...
> On Wed, Oct 19, 2011 at 10:56 PM, Dennis E. Hamilton <>wrote:
> If securityteam@ OO.o is preserved, I believe the oversight of security@
>> and the care of Apache infrastructure is a bonus.
> I disagree. Having an arbitrary steward - regardless of their excellence -
> is not the way to sustain (or indeed rebuild) trust. The correct oversight
> is the list-members themselves.
> Thus I'd propose (in outline):
> *  That be used as the shared meta-community
> security contact list for projects deriving their source code from the
> former Sun-led project. The list would be used for any valid
> meta-community security matter including especially announcement
> co-ordination.
> * That the list should be private to list members (and with the consent of
> the list, to their project's private security list), with mutually agreed
> confidentiality, and populated only with people known to the majority of the
> list members as bona-fides security-related developers.
> *  That the list be populated only with the consent of the existing list
> members (suggested process: a list member proposes a new list member with a
> brief explanation why they are a good-faith and experienced security
> developer in the meta-community. Code-modification-style voting takes place.
> A moderator adds the new member. In the event of mishap, list members may be
> removed using the same process).
> *  Agreeing who the moderators should be by list-member consensus
> I'm sure this needs fleshing out by someone more process oriented, but I
> suggest this outline represents a workable compromise.
> Regards
> S.

View raw message