Mailing-List: contact ooo-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: ooo-dev@incubator.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Subject: Re: Neutral / shared security list ...
From: Michael Meeks <michael.meeks@suse.com>
Reply-To: michael.meeks@suse.com
To: ooo-dev@incubator.apache.org
Date: Tue, 29 Nov 2011 12:17:23 +0000
In-Reply-To: <0A99D18A-AD4A-435C-AB1B-2693549EA1B1@comcast.net>
References: <1319037389.83728.YahooMailMobile@web113502.mail.gq1.yahoo.com>
	 <CAA4ffp8Ds25ExcE9O_GTR0h3id6m2ZCNMRxDne57kt-gtpvj_w@mail.gmail.com>
	 <CAP-ksohpfGdgTGF1Ayswo8Gn2s9BQ_S7QdMx0eDjDDs3QRPX2A@mail.gmail.com>
	 <A4CD6A49-3214-47D3-A742-682AAAE80C85@webmink.com>
	 <34F3347E-B725-4C74-893F-2928417C448C@comcast.net>
	 <1319539654.14345.285.camel@linux-yjtf.site>
	 <6DD077C1-620C-4EF2-8A15-38F20AAF2113@comcast.net>
	 <1319560519.8271.14.camel@linux-yjtf.site>
	 <5F4DA207-C4D2-48FA-AD4E-2F12E6341AB2@comcast.net>
	 <1319565322.22078.10.camel@linux-yjtf.site>
	 <0A99D18A-AD4A-435C-AB1B-2693549EA1B1@comcast.net>
Organization: Novell, Inc.
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Message-ID: <1322569046.21568.56.camel@linux-yjtf.site>
Mime-Version: 1.0

So,

On Tue, 2011-10-25 at 13:00 -0700, Dave Fisher wrote:
> > On Tue, 2011-10-25 at 10:22 -0700, Dave Fisher wrote:
> >> I think we are getting somewhere. The last detail is which is the real ML
> >> and which is the forwarder. While the AOOo project might prefer to have
> > 
> > 	Fair point - for ultra-fairness we should perhaps publish two
> > forwarding addresses - securityteam@oo.o and securityteam@tdf one each,
> > both pointing at the neutrally hosted list.

	So - a quick round up of where we have (not) got here. A month later,
we still have a non-neutrally hosted Apache controlled list, hosted
under Apache's domain, with only AOOI members controlling it's
membership, and an incomplete (from the TDF perspective) membership
list.

	Since there is (apparently) no action here at all, and the most
sensible & friendly options have been exhausted - eg. to have
cross-membership on each other's lists; I've finally got around to
setting up:

	officesecurity@lists.freedesktop.org

	It is intended as a vendor neutral, neutrally hosted list for reporting
security vulnerabilities.

	Dennis Hamilton agreed to be an administrator; it'd be great to get
another administrator or two from the pool people involved in security
to administrate it from the Apache side, and/or any interested
derivatives. I plan to populate it with the tdf-security membership in a
bit.

	It'd also be nice to have a list of guys from your side to subscribe to
it, and/or otherwise (in the meantime) perhaps we should add
ooo-security@incubator.apache.org to be on the safe side.

	All the best,

		Michael.

-- 
michael.meeks@suse.com  <><, Pseudo Engineer, itinerant idiot