We're in the process of changing a few things about how security issues are handled. *1. Security bugs are restricted to members of the 'Security Team' by default.*
We will limit access to security issues to a smaller set of people. This is consistent with how other projects (WebKit, Mozilla for example) handle access to security issues. We haven't done this in the past because we lacked fine-grained access control rules for issues on code.google.com. Previously, all committers and a few additional contributors had access to security issues. The way things were implemented, they also had access to any 'private' issue. The 'private' label encompasses more than security issues and there's no reason to grant every committer access to all 'private' issues. There's also a risk of allowing every committer access to all security issues. We want to be as permissive as possible in granting committer access, but just the opposite is true for security issues that could put millions of users at risk. This might be a bit of a shock to Google employees --who are the majority of our committers and who are used to Google's culture of wide-open access-- but we'll be applying the same restrictions to all committers, regardless of your employer. I've already made a change to limit access to security bugs to project members who have the SecurityTeam token (anyone assigned to a bug or on the CC list will also have access). This will remove access to some security issues for most committers, but it is the easiest way for us to control access and make sure that information that could put our users at risk is controlled. We'll add the SecurityTeam token to the profile of project members who need it. If you think you need access to security bugs in general, let me know (after you look yourself up at http://code.google.com/p/chromium/people/listand verify that you do not already have the SecurityTeam token). Members of the project can nominate others for security bugs access, and I'll document the process on dev.chromium.org ala http://webkit.org/security/. *2. We have a new mailing list, [email protected], for communication about security fixes so that we can coordinate with downstream Chromium releases (for example, Linux distros).* There are a number of downstream projects that depend on Chromium or stable Chromium components like V8. We'll use chromium-security to alert maintainers of these projects about upcoming security fixes so that they can protect their users from known security vulnerabilities. This list will be invite-only, so shoot me an email if you want to be on it (or get someone you work closely with on Chromium to shoot me an email). I won't include everyone; this is a need to know list, and I'll want to have some familiarity with the people we include. Mailing lists are not allowed to subscribe. --Mark --~--~---------~--~----~------------~-------~--~----~ Chromium Developers mailing list: [email protected] View archives, change email options, or unsubscribe: http://groups.google.com/group/chromium-dev -~----------~----~----~----~------~----~------~--~---
