On Tue, 15 Sep 2009 09:58:31 +0200, Przemyslaw Frasunek 
<przemys...@frasunek.com> wrote:
> Giorgos Keramidas wrote:
>> Przemyslaw should email security-officer with any details he thinks are
>> relevant.  Then the security team will make sure to fix the bug for all
>> affected releases of FreeBSD, release a patch with the fix, issue an
>> advisory through the usual channels, and post the details online at our
>> security information web pages at <http://www.FreeBSD.org/security/>.
> I see that I received a lot of criticism after disclosing 6.4 vulnerability.
> Please read some facts:
> I send few mails: on 29th Aug to security team, on 2nd Sep and 11th Sep 
> directly
> to security officer. None of them were responded. I haven't filled any PRs,
> because it would disclose details of vulnerability to the public and allow
> blackhats to exploit it.
> I won't publish anything more than video, before official security advisory. 
> The
> exploit is private to me and it won't be given to the "community".

Hi Przemyslaw,

What I wrote is not criticism for what you have or might have not done.
I now know (after posting the initial message) that the security officer
is preparing a fix and an advisory, so my response was more like ``this
is the usual way of handling this sort of thing''.  The wording was a
bit careful to avoid implying that you didn't know or were not prepared
to do what is appropriate :)

Attachment: pgp6EjWT4Gvtk.pgp
Description: PGP signature

Reply via email to