Re: [Xen-devel] Security vulnerability process

[Mike Bursell <mike.bursell@xxxxxxxxxx>]

On Thu, 2011-08-25 at 12:20 +0100, Ian Jackson wrote:
> Mike Bursell writes ("[Xen-devel] Security vulnerability process"):
> > Proposed changes
> > i. extend the standard embargo period from one week to two to allow more
> > time for response/roll-out.
> 
> Thanks for your comments.
> 
> No-one seems to have objected to this.

Always nice.  :-)

> > ii. allow the standard initial week to flex in the case that a fix is
> > not immediately found.
> 
> I agree with Ian Campbell's comment about this.  The wording:
> 
>   As discussed, we will negotiate with discoverers about disclosure
>   schedule.  Our usual starting point for that negotiation, unless there
>   are reasons to diverge from this, would be:
> 
> makes it clear that this schedule is definitely subject to variation
> depending on the circumstances.  Would you agree ?

That's fine, I think.

> > iii. allow the standard embargo period to be extended, by consensus of
> > those on the predisclosure list, moderated by the Board, to a longer
> > period.  This is to deal with cases where the vulnerability is
> > particularly severe and/or the fixes are particularly onerous to roll
> > out.  
> 
> I don't think this idea is really going to work.
> 
> Firstly, the predisclosure list is an announcement list, not a
> discussion list.  While the list of organisations will be published,
> in general the email addresses on it are busy security contact desks
> who do not want to be involved in extended discussions.
> 
> Secondly, I think it will in practice prove difficult to get consensus
> on an extension - given that the predisclosure list contains some
> organisations who have expectations of a very short timescale and who
> want to fix the problem for their users ASAP.  So such a provision
> wouldn't have much effect other than people sending extra emails.  And
> of course as Ian Campbell says we are still bound by the views of the
> discoverer.
> 
> Finally, even if these practical objections could be dealt with, it
> seems to me to be to be questionable to put the predisclosure list
> members in charge of the decision about when the rest of the users
> find out.  There is a clear conflict of interest there.
> 
> So for those reasons I'm afraid I think it wouldn't be appropriate to
> make that change.

After some thought, I think we're pushing away too far from the
discoverer here.  What I suggest, therefore, is to say

i) explicitly that if the discoverer wishes to extend the predisclosure
period, this will honoured
ii) that if a predisclosure list member wishes to contact the discoverer
to request an extension, that the Xen.org security team will act as a
channel for such requests.

How does this sound?

-Mike.c
-- 
Mike Bursell, Network Subsystem Architect
Citrix Systems R&D.  +44 7971 926937

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel