From predisclosure-applications-bounces@lists.xenproject.org Fri Jul 10 20:15:52 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Fri, 10 Jul 2026 20:15:52 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1359863.1613239 (Exim 4.92) (envelope-from ) id 1wiHdX-0003ig-4Q; Fri, 10 Jul 2026 20:15:51 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1359863.1613239; Fri, 10 Jul 2026 20:15:51 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHdX-0003ic-1j; Fri, 10 Jul 2026 20:15:51 +0000 Received: by outflank-mailman (input) for mailman id 1359863; Fri, 10 Jul 2026 20:14:53 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wiHcb-0003hg-MM for predisclosure-applications@lists.xenproject.org; Fri, 10 Jul 2026 20:14:53 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.96) (envelope-from ) id 1wiHcb-00H4G4-1J; Fri, 10 Jul 2026 20:14:53 +0000 Received: from host-78-146-248-75.as13285.net ([78.146.248.75] helo=[192.168.1.44]) by xenbits.xenproject.org with esmtpsa (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96) (envelope-from ) id 1wiHca-00DBHR-34; Fri, 10 Jul 2026 20:14:53 +0000 X-BeenThere: predisclosure-applications@lists.xenproject.org List-Id: Applications for membership of Xen Security Advisories Pre-disclosure List List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: predisclosure-applications-bounces@lists.xenproject.org Precedence: list Sender: "Predisclosure-applications" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xen.org; s=20200302mail; h=In-Reply-To:From:References:To:Subject:Cc:MIME-Version:Date :Message-ID:Content-Type; bh=3xhdS3SMo1702Q16MqXpcnih0ZPZZL7zBx6mNwHkL+E=; b= gAM3npcDxWPcMyQg1Lh46Wzy1uQL9pTPkgnPpVgKs4L5O0Smg0ZgitxuN0uwa3YEnVvaPRdUQyc4K G6RwkDEo54DSfyXadWZ4EaUIILnaBJ4w/1tkIeAcnTYB9fayTfnlCz595+qMRPSEu1iY2I/iVNXu6 G9AG8DZeolsLIw9sI=; Content-Type: multipart/alternative; boundary="------------qLdKzQnrh0FgkZ1GK4u635E1" Message-ID: <53bfb914-1219-4fc6-a44d-ed25c8004879@xen.org> Date: Fri, 10 Jul 2026 21:14:51 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Cc: Darryl Voss , "alex.brett@citrix.com" Subject: Re: Epic Hosting - Xen Pre-Disclosure Submission To: Jake Vondra , "predisclosure-applications@lists.xenproject.org" References: Content-Language: en-GB From: Andrew Cooper In-Reply-To: This is a multi-part message in MIME format. --------------qLdKzQnrh0FgkZ1GK4u635E1 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On 28/05/2026 6:00 pm, Jake Vondra wrote: > > I am writing to request an addition to the Pre-Disclosure program – my > responses to the requested prompts are in bold below. > >   > > * The name of your organization: *Epic Hosting LLC* > * Domain name(s) which you use to provide Xen software/services: > *epichosted.com* > * A brief description of why you fit the criteria: *we are a large > scale enterprise delivering our integrated healthcare software* > * If not all of your products/services use Xen, a list of (some of) > your products/services (or categories thereof) which do: *we > largely deliver the application presentation layer via XenServer* > * Link(s) to current public web pages, belonging to your > organisation, for each of following pieces of information: > o Evidence of your status as a service/software provider: > *https://www.epic.com/* > o If you are a public hosting provider, your public rates or how > to get a quote: *NA* > o If you are a software provider, how your software can be > downloaded or purchased: *https://www.epic.com/contact/* > * If you are an open-source project, a mailing list archive and/or > version control repository, with active development: *NA* > * Evidence of your status as a user/distributor of Xen:*NA* > o Statements about, or descriptions of, your eligible production > services or released software, from which it is immediately > evident that they use Xen. > * Information about your handling of security problems: > *https://www.epic.com/epic/page/reporting-potential-security-vulnerability/* > o Your invitation to members of the public, who discover > security problems with your products/services, to report them > in confidence to you; > o Specifically, the contact information (email addresses or > other contact instructions) which such a member of the public > should use. > * A statement to the effect that you have read this policy and agree > to abide by the terms for inclusion in the list, specifically the > requirements to regarding confidentiality during an embargo > period: *Acknowledged – this has been reviewed* > * The single (non-personal) email alias you wish added to the > predisclosure list:*XenServer-Notices@epic.com > * > Hello,  Thankyou for your application and sorry for the delay. Most looks to be in order, but NA really isn't ok for your evidence as a user of Xen.  Is there nothing you can point to?  Not even a statement of which platforms are supported by EPIC? Regards, Andrew --------------qLdKzQnrh0FgkZ1GK4u635E1 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit
On 28/05/2026 6:00 pm, Jake Vondra wrote:

I am writing to request an addition to the Pre-Disclosure program – my responses to the requested prompts are in bold below.

 

  • The name of your organization: Epic Hosting LLC
  • Domain name(s) which you use to provide Xen software/services: epichosted.com
  • A brief description of why you fit the criteria: we are a large scale enterprise delivering our integrated healthcare software
  • If not all of your products/services use Xen, a list of (some of) your products/services (or categories thereof) which do: we largely deliver the application presentation layer via XenServer
  • Link(s) to current public web pages, belonging to your organisation, for each of following pieces of information:
    • Evidence of your status as a service/software provider: https://www.epic.com/
    • If you are a public hosting provider, your public rates or how to get a quote: NA
    • If you are a software provider, how your software can be downloaded or purchased: https://www.epic.com/contact/
  • If you are an open-source project, a mailing list archive and/or version control repository, with active development: NA
  • Evidence of your status as a user/distributor of Xen: NA
    • Statements about, or descriptions of, your eligible production services or released software, from which it is immediately evident that they use Xen.
  • Information about your handling of security problems: https://www.epic.com/epic/page/reporting-potential-security-vulnerability/
    • Your invitation to members of the public, who discover security problems with your products/services, to report them in confidence to you;
    • Specifically, the contact information (email addresses or other contact instructions) which such a member of the public should use.
  • A statement to the effect that you have read this policy and agree to abide by the terms for inclusion in the list, specifically the requirements to regarding confidentiality during an embargo period: Acknowledged – this has been reviewed
  • The single (non-personal) email alias you wish added to the predisclosure list: XenServer-Notices@epic.com

Hello,  Thankyou for your application and sorry for the delay.

Most looks to be in order, but NA really isn't ok for your evidence as a user of Xen.  Is there nothing you can point to?  Not even a statement of which platforms are supported by EPIC?

Regards,

Andrew --------------qLdKzQnrh0FgkZ1GK4u635E1-- From predisclosure-applications-bounces@lists.xenproject.org Mon Jul 20 08:09:23 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Mon, 20 Jul 2026 08:09:23 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1362384.1616118 (Exim 4.92) (envelope-from ) id 1wlj3x-0003iK-TM; Mon, 20 Jul 2026 08:09:21 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1362384.1616118; Mon, 20 Jul 2026 08:09:21 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wlj3x-0003iH-QT; Mon, 20 Jul 2026 08:09:21 +0000 Received: by outflank-mailman (input) for mailman id 1362384; Tue, 14 Jul 2026 13:10:04 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wjctg-0006Pq-C4 for predisclosure-applications@lists.xenproject.org; Tue, 14 Jul 2026 13:10:04 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wjcte-007tsd-HP; Tue, 14 Jul 2026 15:10:03 +0200 Received: from [10.42.69.4] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a56351d-5cb7-0a2a0a5109dd-0a2a450480a6-28 for ; Tue, 14 Jul 2026 15:10:02 +0200 Received: from [148.163.150.209] (helo=mx0a-002b1501.pphosted.com) by tlsNG-ebf023.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1) (envelope-from ) id 6a563527-b57f-0a2a45040019-94a396d17dd4-3 for ; Tue, 14 Jul 2026 15:10:01 +0200 Received: from pps.filterd (m0119674.ppops.net [127.0.0.1]) by mx0a-002b1501.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66EBTtdC1103026; Tue, 14 Jul 2026 08:09:57 -0500 Received: from ch4pr04cu002.outbound.protection.outlook.com (mail-northcentralusazon11013000.outbound.protection.outlook.com [40.107.201.0]) by mx0a-002b1501.pphosted.com (PPS) with ESMTPS id 4fd6jr2sk3-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Tue, 14 Jul 2026 08:09:57 -0500 (CDT) Received: from SA1PR17MB5237.namprd17.prod.outlook.com (2603:10b6:806:1d0::23) by PH0PR17MB5488.namprd17.prod.outlook.com (2603:10b6:510:ba::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.223.10; Tue, 14 Jul 2026 13:09:55 +0000 Received: from SA1PR17MB5237.namprd17.prod.outlook.com ([fe80::56ae:705f:50da:4e7e]) by SA1PR17MB5237.namprd17.prod.outlook.com ([fe80::56ae:705f:50da:4e7e%5]) with mapi id 15.21.0202.018; Tue, 14 Jul 2026 13:09:53 +0000 X-BeenThere: predisclosure-applications@lists.xenproject.org List-Id: Applications for membership of Xen Security Advisories Pre-disclosure List List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: predisclosure-applications-bounces@lists.xenproject.org Precedence: list Sender: "Predisclosure-applications" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=2k25 header.d=epic.com header.i="@epic.com" header.h="CC:Content-Type:Date:From:In-Reply-To:Message-ID:MIME-Version:References:Subject:To"; dkim=pass header.s=selector1 header.d=epic.com header.i="@epic.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epic.com; h=cc :content-type:date:from:in-reply-to:message-id:mime-version :references:subject:to; s=2k25; bh=dAdSJZ/mYF9eD4mAidsP6wr1ZLNRm OvnNXcIi/VdJhU=; b=kss7x4gFdSXD34jHAx0cpTum+sTBg7pSFeHGOOrfuMA/t TZ+PhQ/sLd43hQuZmbCcLK1Cp4zEbk30G8G7Abi8ekGeb2ZjkfBXObMYIrAEyAQh qoovE6xUJHw8JLaZdPtvEI8bGI31rLf1AsHl9gqoASynlfJd/VKpzre79qOkoSSf +Vc5YyzJuB9utCVccFGUuD7F+CpDCH8L0YJ5NOO0pj4rhzk5tnTsPGBGo45cgdOv wyoSNfMEaIOD5h1C2v4gFuA2xHH52oAmm4u6el+Hqiyke6cUg8+lOfsJUKi4B1Xn DWPEzuC043oKqvgj13eGaPIYnJG1vqIP+6SRnKwUQ== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=iWQXpHvSV24HoTO2DyCTDLuRcadJMUWZyUhBSzTuEzQw2TEf8pR5trRm5/6k2NqpqH05Dg5yYOqiOubwAPNNv7b+5CkOu+SifwA40EZIz7vapd1B08/SwS+3pQH1Ztgxs6wvtLLfH8JtkfP1B/jxESK/cYfJrpmjiKgINqVtGKnUjAKzpc2YgdxNOa7GIj0csmTl0u1gmNYLuM5rZoNBHs/v5/fOtDF7LCnRnj3+Ln6HuUcM6Mxg9XRUqWcUkQTNXOPbJVKayHpuXoHiHEe+p3FgLXBi7OIR7vt7gEW+V5O+nxqcloJ+vqMDruhXv/ENhgCXd2/WdZ9pq6n5BoIw6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=dAdSJZ/mYF9eD4mAidsP6wr1ZLNRmOvnNXcIi/VdJhU=; b=qzQ0BU/vmy7MvxYY5LVrp4fvwlayUrxta2adv22kcMMtGA05yPV1BF/RoLro2J/AlXW4sfyBv/HsfR+NIS867Ne+vqnFp9t6L4YvY/stD8dnRI4hLepE/kuhgJxpaVB/LGFLPAT45DPl5Hskc2zjlXkdNH8vcL5gALarwoJFR0a1hUa5v7GEaSfIgKlf1+vQlMyI6rBYQbUgUDmNaXeR6i+Vgr1LHLi2djSe7qMoefwlC8R1jM+3E3t6z50lISxDkJ18qp2+ZBvlQMnh6LIegJfsSNgz/6KQsKnvHQGJZ4zeL6EMgPmoMmm7Buccg5qrRaO0syjqj0bSPllD+0d3gA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epic.com; dmarc=pass action=none header.from=epic.com; dkim=pass header.d=epic.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epic.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dAdSJZ/mYF9eD4mAidsP6wr1ZLNRmOvnNXcIi/VdJhU=; b=IJ/pJ1x1J8zbC+OkJjnmsm8o52FSra/1x06X9xJdR6Dl8lJOkiFe6oT9ihyO+QjobBHIwktKTaJlQ+RduZ5szDaMb9bQPmvXx8A0nDqSKheoaD1sofi/lYEh4mlrtMjzd5zqavYhaY7dho3FahdFJydmZO053xR3Wyy5dtClM70= From: Darryl Voss To: Andrew Cooper , Jake Vondra , "predisclosure-applications@lists.xenproject.org" CC: "alex.brett@citrix.com" Subject: Re: Epic Hosting - Xen Pre-Disclosure Submission Thread-Topic: Epic Hosting - Xen Pre-Disclosure Submission Thread-Index: AdzuwttRETC9w6WvTPmhZ/dQ5WoDwAh5egaAALoSECQ= Date: Tue, 14 Jul 2026 13:09:51 +0000 Message-ID: References: <53bfb914-1219-4fc6-a44d-ed25c8004879@xen.org> In-Reply-To: <53bfb914-1219-4fc6-a44d-ed25c8004879@xen.org> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: SA1PR17MB5237:EE_|PH0PR17MB5488:EE_ x-ms-office365-filtering-correlation-id: f2c54ee2-e49c-4ea3-32e9-08dee1a9311f x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|1800799024|366016|376014|23010399003|3023799007|4143699003|56012099006|11063799006|5023799004|18002099003|22082099003|8096899003|13003099007|38070700021; x-microsoft-antispam-message-info: mpnAEnnIk9IisJeSyeVwUXWZcFIItfl+GiLAikdMCFRz5F97AWItyvm1KZMKpODfEwsFCdKSgyRVoewF12NJbILsiRg/6OVEDHhclf6Lov2ZqCUOJYCKg8emtGTESa1Lvt6IBAxmmIJlnYuturI1Xi8P5JcQ20vWHm50oBp4co2mAr7pnJQFkPsU7vTSYg08uc527jPywlexnfSljPdCn04AbVAbbs/Z2dSQg+3KtU1vvuBp9f8q0FaAkEmUnED+EijUZGVy7A1atwvfPMt/QZxc+4XsjXBJKUTx3GNoA0fELaz2rxYKPkrPU1eEwxYWfb5xCdVwNQhIPqqtF/iyNBKec5s63z2F9NI+Wp+K8v5IEfu5F7DjYy037DZ9bS3hyhGJlYSiS8eSZDSNsKU69XRWPL320VCoR5moTJXWu2kP9QgYpAbtzrVFaayV6/FuhJr6rrao6cOE2mdxUQJiW2MyxbG/qKYS/Ad8+IFwN819xe1N+mdCjzExMZotlsGCdhgqf2TPIsPWleJ040Z7GKs6kOCQQ9OmgAX9eu/vkPDPoR6nGv/4A0+PFRCijuTasra6yjOCblQsEovfYEYYpRdqqvCwllr4yheGgQLahrcK2x2pWf7XXodx42DhbSB215x1ncJ44ZGl63OB5hzzbBj5BTbeRRWT+DwDMmrKJyQ= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SA1PR17MB5237.namprd17.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(376014)(23010399003)(3023799007)(4143699003)(56012099006)(11063799006)(5023799004)(18002099003)(22082099003)(8096899003)(13003099007)(38070700021);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?bOBEtsPMF3wicx88/vrrw62ZqtORpOyjehH9XzocM8yuL+7l/HzvFma3bj?= =?iso-8859-1?Q?HSzKAz46mpuCt0OPsR7xo6Sc0ZYhKbTVx8lEO6DpW24izhZdsXfgwe4fyp?= =?iso-8859-1?Q?mvR2PKG+aivU3pM93KOaEI/dRptjk9yixSNEjRB0DDX2togGGNV+PaCqcz?= =?iso-8859-1?Q?pq6/HkrvaujQE5OHHN9PB6k9quV4HtqtWBLJ/aYZV9WeUaZppQJj24/hk5?= =?iso-8859-1?Q?xvMm31urv/u5CweWa3tqxvYh6vhPVlKXHMc2v1nWpeNwMDXR4PI0NqThWB?= =?iso-8859-1?Q?3PEA2q2eH0b5nftGofGQFjTqZBP5N1gU7tkP7apGXCT2DsnonAHxozoTmw?= =?iso-8859-1?Q?XVt8DBtHdkIY0Ushdne96GZdQ7h70uP3eCCuEacfTiKZI/Kje/+deTp2dM?= =?iso-8859-1?Q?M+5AxhMa1YWSMF68yX3yGT+Dkz7HR6Bhn1cimppRvRFm58w9gb+yqpYSUm?= =?iso-8859-1?Q?bvF5f9sGPWLxFb2BEUHr6leN4cvWZHAbw/HDVyrX/lehGAlT01vU1ySVqS?= =?iso-8859-1?Q?pnEhZcw+syhINNFnC7XgaY2YOtKSE/YWwvlHs7osvNOhEftBLofWdZdOAW?= =?iso-8859-1?Q?iRK0PCi3jN55Bzza1w4kiZUyZEbWhBe7i/JW1OuTDnM1/L5YDTIrczV7I+?= =?iso-8859-1?Q?uuU7g1NNuSpdlxPdGu1UA2ED3AQqJ4ehuoLMlEby+LleORi7tTbI8ooJe3?= =?iso-8859-1?Q?LELY47psZpPG8jIiTBh+/Kh7v/LRPIm0zgTUku0LxAYzjc1ciJAtIbVgKV?= =?iso-8859-1?Q?p8mEFDSWjFk+TWJU5tQOQ58DpT5vcq7N27KfXyl3lNNy2gkbaRfOwPwkeh?= =?iso-8859-1?Q?B5GZnOEw0l3XEuybkNZ9kpd64LKLrUM8cgeC3KvOv4/JxDgtRioJ7ehVwa?= =?iso-8859-1?Q?16V7Xi7sHFYJDUYVcD3HAsgHnFhEkKID32eeIIFIqhJLb8b7M/UFTcouw2?= =?iso-8859-1?Q?p+bY6Agy5oVwnqF6YGYwjRd8N6ucMs8o9Uzi0VTCLJudID54FW95J6fpy+?= =?iso-8859-1?Q?dAEmO2q/Pif7OpzVcjmjth8OrUks9Pptxq9z7Q45z3oTGo43cOn/r92JcD?= =?iso-8859-1?Q?mu0o3G+AGqN2b9X6YRn2GF6t0AKp9H7nRolT6jSLKrzR4h9lKrgCII6qsX?= =?iso-8859-1?Q?t0ZF3koX+ksI4Y4wxpPv9k6ozIQti/PVIPtlH1PYW98iEdQH4bMe2p6wKM?= =?iso-8859-1?Q?hhiZpOagg3D3hsrHXoJ8FpuM1sXUwNTjPav7xNtdOj0BcYJ08+/81WTS1l?= =?iso-8859-1?Q?NaG2Xuhtcj5iCM5q+P38hXg54Q4rynLqPn8IY4fe8513IZEV6PMIU41ji7?= =?iso-8859-1?Q?8XsYT1XxsvYeNu6dX5pp/Koc3iUudL9+coC/1VIV8m6rKXOy+ASGRZmvsT?= =?iso-8859-1?Q?Dm5+/ThNffxGEwl0x2RVuMsiGZ+4tLRSJptA2+vrJX/JQllsJpheW6VbGg?= =?iso-8859-1?Q?fN1YFejYwwLtfB2Ob6Y7uLQtSsdwnwdlAClU08NPG9AGAtIEYss7PCOZfm?= =?iso-8859-1?Q?Bv9jZubcESlOxcezbU1j0ivCdM4Zx8vqz/oPxWoTJwKBpGhgHhoOmkp/ox?= =?iso-8859-1?Q?UXX0ftNEfd3hvZqb8VCmRdPCBPSen5/3imurdALWwtH9RqeVMBn6BAS9d5?= =?iso-8859-1?Q?tMnv57ngFuMb0pc97Zjex66aEqYHAzyfxqyz5lL0updwShE5ygRvq/Wx4s?= =?iso-8859-1?Q?ooCFsNwdk9CeePuXCYaNDLu52aEiEkyQliclJIb20GWQ46gj1phi2sp9iJ?= =?iso-8859-1?Q?CKBI9hQLNhkmE+VhdiKACMZG4l4eci1M9Nsu6cqOikOrru?= Content-Type: multipart/alternative; boundary="_000_SA1PR17MB5237341483F76B81D9AFB369BAF92SA1PR17MB5237namp_" MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: NjxtcOrLVnxZ0XGhg+bZG9Igvj6tG8kbj0QfpxVTDUy8GbARYWJqPbGSZUvtAVNTI8Ia6FV17wbu1I4cDjnb+6DHm4Z2aA0079y79zwuDF55MirB7Fg8GAz6d7h4Q7eZKJHqSuksYeORDIKLCHnbJzfk5flopInL5o3JOrYY6D/5WBIrUQt4IO+h7B/KlASPiZmLYqWArGmaEmg12cpp1kab0VvSzqTSQJL07mVN9DnygfyWcY5Gu6UJdsT5+m44WlUqnrcU2qtsucMpZ0D69h24C1NfECCZx3gSrjDL6j8j1tBauzVeILXFV+8E/oBKdwADqv3aa1BaHhzfLpT/kQ== X-OriginatorOrg: epic.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: SA1PR17MB5237.namprd17.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: f2c54ee2-e49c-4ea3-32e9-08dee1a9311f X-MS-Exchange-CrossTenant-originalarrivaltime: 14 Jul 2026 13:09:52.1730 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: d8d598e0-2fb2-4605-8514-1967b50e2bd6 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: oGY4iO3/xLTeYk6YZpGP68xA15isuny+eN19yyolSxucD08lauW48xCAAxT+hohz X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR17MB5488 X-Proofpoint-ORIG-GUID: ncW96COTJ5tXLqfqYZ1SONXzjWvm7K3J X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE0MDEzNiBTYWx0ZWRfXxFzYpfLRnSkB lIoEH2WZw4TFpCLqSYOZhLMCDV3L/2QqdmIZ8kMaJlw+Fnop9ScQDYmdFp/dOdmg95EbIuBi7zJ /Uj7q/KRfVoHElzo2wbDcvg9kqJNX7joE9uMgRt1qngxpaQgQ/OadESH7G8MpsuYbk/i9XT32qj PuR7YiCghNMzodUQnQYfVQhrEdNg6ymYSIS+p+FmTWGPaDuVwahqw66pOHioWcXwR2PveTBLPN6 2Lax6N8G2C4LStmaAG+L44wtzJjZbeakjo0gm9t0puBbZxhIkrAj0pjohg55HAl2q9u5glgxGX0 zU5h+LcfzGUQGRdH2/M1zFE6Y1yCRHi9/4CCyXQkmiMIU0AYpRIF7QwIkM6HCjBEjVqT26WDJ8I hme1KVkJ9Il31+DNsM4tMDSN3jl21HKZQu0h2SZkLQv/TBYj4A/umg6Y17IiubbeXS74Od54Bsi 5PqR9aEYqXuLijor85g== X-Authority-Analysis: v=2.4 cv=cPfQdFeN c=1 sm=1 tr=0 ts=6a563525 cx=c_pps a=kza0H2G5rmQD+2VTu+diIA==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=RAioF0-LDSMA:10 a=fLxXaBswY2kA:10 a=VkNPw1HP01LnGYTKEx00:22 a=HcFE1RN0hNOP7eReKWeE:22 a=P0RlT_VnH5C7E9ilbX4w:22 a=nqngphQYAAAA:8 a=mLnsDVdbAAAA:8 a=cWRNjhkoAAAA:8 a=tHz9FfFoAAAA:8 a=KiA8O_NwAAAA:8 a=npLHwlwXjtVv-XZOX8UA:9 a=lqcHg5cX4UMA:10 a=wPNLvfGTeEIA:10 a=LwHoF-TZM-5o7Qfgk60A:9 a=f1E7XRzm4VU6q5dY:21 a=frz4AuCg-hUA:10 a=_W_S_7VecoQA:10 a=l3Kf0c7r5vjhVLBHvrpp:22 a=xnp1pY6zelCj5OLna2To:22 a=sVa6W5Aao32NNC1mekxh:22 a=E2LB0w4p2F9oaE3r9NTf:22 X-Proofpoint-GUID: ncW96COTJ5tXLqfqYZ1SONXzjWvm7K3J X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE0MDEzNiBTYWx0ZWRfX+r5l+hEBYogP lenCMQMIr1GRxHHt1dhLHLItk3ZiF2X1PLkMIc7iMg9Po4hMzfWyRnekDwNeHRE14vgCahYrgvz M+S7vK5VFeDbMkEVHasNSgKZCs+FgAk= X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 lowpriorityscore=0 phishscore=0 suspectscore=0 clxscore=1011 spamscore=0 malwarescore=0 impostorscore=0 bulkscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607140136 X-purgate-ID: tlsNG-ebf023/1784034602-50CDFB50-9F283BDE/0/0 X-purgate-type: clean X-purgate-size: 12464 --_000_SA1PR17MB5237341483F76B81D9AFB369BAF92SA1PR17MB5237namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi Andrew- We're a hosting provider, so we generally don't publicize the infrastructur= e platforms we use for our customers. Because of that, we don't have much p= ublicly available evidence of our status as a XenServer user. I can provide our current XenServer host count if that would satisfy the re= quest, but I'm not sure what additional evidence I could offer. I also beli= eve you were directly involved with the AMD Turin microcode issue about a y= ear ago. We wouldn't have been pushing for that microcode update if we were= n't heavily using XenServer. Would that be sufficient to qualify as evidenc= e? Darryl ________________________________ From: Andrew Cooper Sent: Friday, July 10, 2026 3:14 PM To: Jake Vondra ; predisclosure-applications@lists.xenpro= ject.org Cc: Darryl Voss ; alex.brett@citrix.com Subject: Re: Epic Hosting - Xen Pre-Disclosure Submission External Mail. Careful of links / attachments. Submit Helpdesk if unsure. On 28/05/2026 6:00 pm, Jake Vondra wrote: I am writing to request an addition to the Pre-Disclosure program - my resp= onses to the requested prompts are in bold below. * The name of your organization: Epic Hosting LLC * Domain name(s) which you use to provide Xen software/services: epicho= sted.com * A brief description of why you fit the criteria: we are a large scale= enterprise delivering our integrated healthcare software * If not all of your products/services use Xen, a list of (some of) you= r products/services (or categories thereof) which do: we largely deliver th= e application presentation layer via XenServer * Link(s) to current public web pages, belonging to your organisation, = for each of following pieces of information: * Evidence of your status as a service/software provider: https://ww= w.epic.com/ * If you are a public hosting provider, your public rates or how to = get a quote: NA * If you are a software provider, how your software can be downloade= d or purchased: https://www.epic.com/contact/ * If you are an open-source project, a mailing list archive and/or vers= ion control repository, with active development: NA * Evidence of your status as a user/distributor of Xen: NA * Statements about, or descriptions of, your eligible production ser= vices or released software, from which it is immediately evident that they = use Xen. * Information about your handling of security problems: https://www.epi= c.com/epic/page/reporting-potential-security-vulnerability/ * Your invitation to members of the public, who discover security pr= oblems with your products/services, to report them in confidence to you; * Specifically, the contact information (email addresses or other co= ntact instructions) which such a member of the public should use. * A statement to the effect that you have read this policy and agree to= abide by the terms for inclusion in the list, specifically the requirement= s to regarding confidentiality during an embargo period: Acknowledged - thi= s has been reviewed * The single (non-personal) email alias you wish added to the predisclo= sure list: XenServer-Notices@epic.com Hello, Thankyou for your application and sorry for the delay. Most looks to be in order, but NA really isn't ok for your evidence as a us= er of Xen. Is there nothing you can point to? Not even a statement of whi= ch platforms are supported by EPIC? Regards, Andrew --_000_SA1PR17MB5237341483F76B81D9AFB369BAF92SA1PR17MB5237namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hi Andrew-
We’re a hosting provider, so we generally don’t publicize the i= nfrastructure platforms we use for our customers. Because of that, we don&#= 8217;t have much publicly available evidence of our status as a XenServer u= ser.
I can provide our current XenServer host count if that would satisfy the re= quest, but I’m not sure what additional evidence I could offer. I als= o believe you were directly involved with the AMD Turin microcode issue abo= ut a year ago. We wouldn’t have been pushing for that microcode update if we weren’t heavily using XenServer. Wou= ld that be sufficient to qualify as evidence?
Darryl


From: Andrew Cooper <andrew@xen.org>
Sent: Friday, July 10, 2026 3:14 PM
To: Jake Vondra <jvondra@epic.com>; predisclosure-applica= tions@lists.xenproject.org <predisclosure-applications@lists.xenproject.= org>
Cc: Darryl Voss <Darryl@epic.com>; alex.brett@citrix.com = <alex.brett@citrix.com>
Subject: Re: Epic Hosting - Xen Pre-Disclosure Submission

External Mail. Careful of links / attachments. Submit Helpdesk = if unsure.

On 28/05/2026 6:00 pm, Jake Vondra wrote:

= I am writing to request an addition to the Pre-Disclosure program – m= y responses to the requested prompts are in bold below.

=  

  • The name of your organization: Epic Hosting LLC
  • Domain name(s) which you use to provide Xen so= ftware/services: epichosted.com
  • A brief description of why you fit the criteria: we are a large scale enterprise delivering our integrated healthcare sof= tware
  • If not all of your products/services use Xen, a list of (som= e of) your products/services (or categories thereof) which do: we largely deliver the application presentation layer via XenServer<= /li>
  • Link(s) to current public web pages, belonging to your organisation, f= or each of following pieces of information:
    • Evidence of your status as a service/software provider: https://www.epic.com/
    • If you are a public hosting provider, your public rates or how to g= et a quote: NA
    • If you are a software provider, how your software can be dow= nloaded or purchased: https://www.epic.com/contact/
  • If you are an open-source project, a mailing list archive and/or version c= ontrol repository, with active development: NA
  • Evidence of your status as a user/distributor of Xen:&nbs= p;NA
    • Statements about, or descriptions of, your eligible production services or= released software, from which it is immediately evident that they use Xen.=
  • Information about your handling of security problems: https://www.epic.com/epic/page/reporting-potential-security-v= ulnerability/
    • Your invitation to members of the public, who discover security problems w= ith your products/services, to report them in confidence to you;
    • Speci= fically, the contact information (email addresses or other contact instruct= ions) which such a member of the public should use.
  • A statement to the effect that you have read this policy and agree to abid= e by the terms for inclusion in the list, specifically the requirements to = regarding confidentiality during an embargo period: Acknowledged – this has been reviewed
    • Th= e single (non-personal) email alias you wish added to the predisclosure lis= t: XenServer-= Notices@epic.com

Hello,  Thankyou for your application and sorry for the delay.

Most looks to be in order, but NA really isn't ok for your evidence as a us= er of Xen.  Is there nothing you can point to?  Not even a statem= ent of which platforms are supported by EPIC?

Regards,

Andrew
--_000_SA1PR17MB5237341483F76B81D9AFB369BAF92SA1PR17MB5237namp_--