Xen project Mailing List

Re: [Predisclosure-applications] Application for addition to Xen predisclosure list.

To: Ian Campbell <ian.campbell@xxxxxxxxxx>

From: Simon Crosby <simon@xxxxxxxxxxx>

Date: Wed, 18 Mar 2015 19:33:56 -0700

Cc: predisclosure-applications@xxxxxxxxxxxxxxxxxxxx, Security <security@xxxxxxxxxxx>, Xen Predisclosure <xen-predisclosure-advisory@xxxxxxxxxxx>

Delivery-date: Thu, 19 Mar 2015 02:34:03 +0000

List-id: Applications for membership of Xen Security Advisories Pre-disclosure List <predisclosure-applications.lists.xenproject.org>

Thread-index: AQJZmkmo8O+LHuzkutEA1DkLpv2eogIVe02Tm//Zm4A=

Ian

I've provided what I believe are the missing bits of information below.Â

Moved to HTML so you can see my inline edits in color, prefixed [SC>].

Many thanks for your quick response

Simon

CTO, Bromium Inc.

@simoncrosby

-----Original Message-----
From: Ian Campbell [mailto:ian.campbell@xxxxxxxxxx]
Sent: Wednesday, March 18, 2015 2:49 AM
To: Simon Crosby
Cc: predisclosure-applications@xxxxxxxxxxxxxxxxxxxx; security@xxxxxxxxxxx; xen-predisclosure-advisory@xxxxxxxxxxx
Subject: Re: [Predisclosure-applications] Application for addition to Xen predisclosure list.

On Mon, 2015-03-16 at 13:11 -0700, Simon Crosby wrote:

> Applicant: Bromium, Inc.

We take it you are applying under the "Vendors of Xen-based systems"

case.

[SC >] YesÂÂÂÂÂÂÂÂÂ

The Xen project security policy requires us to ask for "Link(s) to current public web pages, belonging to your organisation," for each piece of information, where a couple seem to be missing from your

application:

ÂÂÂÂÂ * For "Evidence of your status as a service/software provider":

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ If you are a software provider, how your software can be

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ downloaded or purchased.

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ(There are other options, this seems to be the one which

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ would apply in your case)

[SC >] Our products are not available for download.Â Email to sales@xxxxxxxxxxx is the best way to learn how to purchase our products, or you can fill out a web form here.Â There is no online purchase option.

ÂÂÂÂÂ * For "Information about your handling of security problems":

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ Your invitation to members of the public, who discover

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ security problems with your products/services, to report

ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ them in confidence to you;

[SC >] The Contact page on our site asks anyone that discovers a security issue with our product to email us in confidence at security@xxxxxxxxxxx

With those I think we should be able to process your request.

Thanks,

Ian.

_______________________________________________ Predisclosure-applications mailing list Predisclosure-applications@xxxxxxxxxxxxxxxxxxxx http://lists.xenproject.org/cgi-bin/mailman/listinfo/predisclosure-applications