Mailing-List: contact ooo-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: ooo-dev@incubator.apache.org
Received-SPF: neutral (nike.apache.org: 98.139.44.157 is neither permitted nor
 denied by domain of kay.schenk@gmail.com)
Message-ID: <4EA70DEB.6000607@gmail.com>
Date: Tue, 25 Oct 2011 12:28:43 -0700
From: Kay Schenk <kay.schenk@gmail.com>
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US;
 rv:1.9.2.23) Gecko/20110920 SUSE/3.1.15 Thunderbird/3.1.15
MIME-Version: 1.0
To: ooo-dev@incubator.apache.org
Subject: Re: [Proposal] Security coordination without a shared list
References: 
 <CAP-ksogqMmkJvHGqeVrpQgAXo3Dsz6P=s51pjjBc-AYrf=qcJg@mail.gmail.com>
In-Reply-To: 
 <CAP-ksogqMmkJvHGqeVrpQgAXo3Dsz6P=s51pjjBc-AYrf=qcJg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit


On 10/25/2011 09:08 AM, Rob Weir wrote:
> There is an easy way to avoid all the trust issues with regards to
> shared mailing lists.  Don't have such a list.  Trust individuals.
> This proposal takes this approach.

Actually I personally like this idea. Why? There have been many 
statements/testimonies to the fact that the LO  contains a great deal of 
code that is NOT in any of the OOo releases, and is now quite different. 
And, presumably, the LO development will continue to be different enough 
to warrant it's own separate universe of mailing lists. I think at some 
point if we decided we really truly wanted to have a shared security 
list, it would become very difficult to determine who was the 
responsible party for the grievances. I might be exaggerating the 
problems since I'm not a developer, but, then again, maybe not.

So, although I'd love to see us work more closely with LO, I believe 
separate security lists are in order.

>
> 1) The AOOo PMC solicits the names of security contacts from related
> projects who wish to be consulted related to pre-disclosure
> coordination related to analysis and resolution of reported security
> vulnerabilities.  Names of individuals are preferred over opaque
> mailing lists.  Trust can be established based on a PGP/GPG web of
> trust.  These names and addresses are stored confidentially in the
> PPMC's private SVN directory.
>
> 2) The AOOo security team reaches out to these contacts, as
> appropriate,v ia their preferred contact mechanism,  to coordinate on
> specific vulnerabilities.  We (Apache) would cc ooo-security on our
> external emails, as required by Apache policy [1].
>
> 3) Other groups would be encouraged to reach out to AOOo in similar
> circumstances via our preferred contact mechanism, ooo-security.
>
> 4) This fully allows targeted collaboration on specific issues, via
> each project's preferred contact mechanism,  without requiring the
> maintenance of an additional email list.
>
> 5)  If we want to discuss security in general, then that can/should
> happen on public dev lists.    That public discussion could occur
> anywhere.
>
>
> [1]: http://www.apache.org/security/committers.html

-- 
------------------------------------------------------------------------
MzK

"This is no social crisis
  Just another tricky day for you."
                  -- "Tricky Day", the Who