Re: [Xen-devel] Possible improvement to Xen Security Response Process

["Jan Beulich" <JBeulich@xxxxxxxx>]

>>> On 05.12.16 at 15:17, <matthew.allen@xxxxxxxxxx> wrote:
> From a security purist point of view, any delay in publication could 
> increase the possibility of vulnerabilities being exploited in the
> wild.  However, given the significant frequency of publication of XSAs,
> I’d suggest that users failing to keep up with the publication rate
> is presently a much greater security risk.
> 
> If XSAs were to be batched, we should also consider if batch updates 
> should be encouraged to be on pre-defined dates.  The present
> unpredictability makes it unnecessarily more difficult for users of
> Xen to plan their lives.  For example, our present process causes 
> organisations with few administrators to choose between cancelling
> holidays or not patching.
> 
> Obviously, some issues are discussed in public before the security 
> impact is realised (such as XSA-201); equally, the right to set 
> a disclosure date (if any) rests with the discoverer.  However,
> my experience of other software (which may not be typical) has been
> that discoverers are usually happy to go along with any reasonable
> proposed date given in the same way that discoverers of XSAs are
> usually happy to conform to our present policy.
> 
> If this seems a good idea, then I’ll post a concrete proposal but 
> I’d like to get general feedback first.

I think very much here depends on the concrete aspects of the
proposal (timing, room for exceptions, etc). From just a general
pov, I can see advantages and disadvantages to both, just like
you've indicated yourself already. Also it shouldn't be left out of
consideration that for less severe vulnerabilities consuming
parties could decide for themselves whether to delay patching
(and hence leverage batching); I'm not convinced it would be a
good idea to require the XenProject Security Team to take this
decision in all cases.

Jan

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel