Re: [Xen-devel] Security vulnerability process, and CVE-2012-0217

[George Dunlap <George.Dunlap@xxxxxxxxxxxxx>]

On Wed, Jul 4, 2012 at 1:52 PM, Jan Beulich <JBeulich@xxxxxxxx> wrote:
> Being on the list doesn't make you non-susceptible. Such an
> approach, imo, would need to imply permission to anyone on
> the list to deploy a fix as soon as it is available. But since
> distros can't ship binaries without also making sources available,
> that's a contradiction by itself.

Yes, preventing vendors from shipping until the public disclosure date
would discriminates against "vendor-supplied" users in favor of
"self-supplied" users (i.e., those who download and build their own
directly from xen.org).

Would it work to say that vendors can ship to anyone on the list?  In
theory that could work, but in practice I think most distros would
rather just release once and be done with it, rather than dealing with
a 2-stage process.

 -George

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel