Re: [PATCH v1 1/1] security-process: update process information

2020-12-03 Thread Daniel P . Berrangé
On Thu, Dec 03, 2020 at 11:32:44AM +0530, P J P wrote: > +-- On Wed, 2 Dec 2020, Daniel P. Berrangé wrote --+ > | > +- If issue is found to be less severe, an upstream public bug (or an > | > + issue) will be created immediately. > | > | No need to repeat "or an issue". I think it would

Re: [PATCH v1 1/1] security-process: update process information

2020-12-02 Thread P J P
+-- On Wed, 2 Dec 2020, Daniel P. Berrangé wrote --+ | > +- If issue is found to be less severe, an upstream public bug (or an | > + issue) will be created immediately. | | No need to repeat "or an issue". I think it would read more clearly as | |- If the severity of the issue is

Re: [PATCH v1 1/1] security-process: update process information

2020-12-02 Thread P J P
Hello Dan, Stefano, +-- On Wed, 2 Dec 2020, Stefano Stabellini wrote --+ | On Wed, 2 Dec 2020, Daniel P. Berrangé wrote: | > > + any third parties, including Xen Security Project, without your prior | > > + permission. | > | > Why this explicit note about the Xen project ? What if we decide

Re: [PATCH v1 1/1] security-process: update process information

2020-12-02 Thread P J P
Hello Dan, +-- On Wed, 2 Dec 2020, Daniel P. Berrangé wrote --+ | > +- If issue is found to be less severe, an upstream public bug (or an | > + issue) will be created immediately. | | No need to repeat "or an issue". I think it would read more clearly as | |- If the severity of

Re: [PATCH v1 1/1] security-process: update process information

2020-12-02 Thread P J P
+-- On Wed, 2 Dec 2020, Philippe Mathieu-Daudé wrote --+ | Maybe: | | 0) **Acknowledge reception** |- A non-automated response email is sent to acknowledge the | reception of the request. | This is the starting date for the maximum **60 days** required | to

Re: [PATCH v1 1/1] security-process: update process information

2020-12-02 Thread Stefano Stabellini
On Wed, 2 Dec 2020, Daniel P. Berrangé wrote: > On Mon, Nov 30, 2020 at 07:19:07PM +0530, P J P wrote: > > From: Prasad J Pandit > > > > We are about to introduce a qemu-security mailing list to report > > and triage QEMU security issues. > > > > Update the QEMU security process web page with

Re: [PATCH v1 1/1] security-process: update process information

2020-12-02 Thread Philippe Mathieu-Daudé
Hi Prasad, On 11/30/20 2:49 PM, P J P wrote: > From: Prasad J Pandit > ... > +## How we respond: > + > +* Process of handling security issues can be divided in two halves. > + Maybe: 0) **Acknowledge reception** - A non-automated response email is sent to acknowledge the

Re: [PATCH v1 1/1] security-process: update process information

2020-12-02 Thread Daniel P . Berrangé
On Mon, Nov 30, 2020 at 07:19:07PM +0530, P J P wrote: > From: Prasad J Pandit > > We are about to introduce a qemu-security mailing list to report > and triage QEMU security issues. > > Update the QEMU security process web page with new mailing list > and triage details. > > Signed-off-by:

Re: [PATCH v1 1/1] security-process: update process information

2020-12-02 Thread P J P
Hello Konrad, all +-- On Tue, 1 Dec 2020, Konrad Rzeszutek Wilk wrote --+ | On Mon, Nov 30, 2020 at 07:19:07PM +0530, P J P wrote: | > We are about to introduce a qemu-security mailing list to report | > and triage QEMU security issues. | > Update the QEMU security process web page with new

Re: [PATCH v1 1/1] security-process: update process information

2020-12-01 Thread Konrad Rzeszutek Wilk
On Mon, Nov 30, 2020 at 07:19:07PM +0530, P J P wrote: > From: Prasad J Pandit > > We are about to introduce a qemu-security mailing list to report > and triage QEMU security issues. > > Update the QEMU security process web page with new mailing list > and triage details. > > Signed-off-by: