Re: [Xen-devel] [PATCH RFC] Make all public hosting providers eligible for the pre-disclosure list

[George Dunlap <George.Dunlap@xxxxxxxxxxxxx>]

On Tue, Nov 27, 2012 at 12:05 PM, George Dunlap <George.Dunlap@xxxxxxxxxxxxx> wrote:

On Mon, Nov 19, 2012 at 5:42 PM, Ian Campbell <Ian.Campbell@xxxxxxxxxx> wrote:

> +    <p>Here as a rule of thumb, "public hosting provider" means

> +    "selling virtualization services to the general public";
> +    "large-scale" and "widely deployed" means an installed base of
> +    300,000 or more Xen guests.  Other well-established organisations
> +    with a mature security response process will be considered on a
> +    case-by-case basis.</p>

I agree with Ian that relaxing this for software vendors also seems the
correct thing to do.

If we're going to include software vendors, we need some simple criteria to define what a "real" software vendor is.  The idea of asking for a link from cloud providers pointing to public rates and a security policy, which Ian Jackson proffered, was a good one.  I suppose we could do something similar for software providers: a link to a web page with either download-able install images, or prices, perhaps?

Thinking a bit more about this one -- if someone had (say) a Debian derivative that looked like it was basically just a different default set of packages -- IOW, a very small amount of effort to create and maintain -- that wouldn't qualify for being on the list, right?  So it seems to me like "amount of effort spent" is kind of what we're looking for, right?  I mean, if 2-3 developers are spending 3-4 hours per week each working on something, then it's clearly a project we could consider, even if it's really small.  I'm sure that would include QubesOS, ArchLinux, Edubuntu, Scientific Linux, &c &c.  But if it's one guy spending half an hour every six months, he doesn't really need to be on the list I don't think.

This would be a "rule of thumb" or "guideline" rather than a rule.

Thoughts?

 -George

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel