Acknowledging documented restrictions on use of info from private security repos about security-wg HOT 20 CLOSED

I acknowledge.

from security-wg.

ACK

from security-wg.

from security-wg.

I acknowledge.

from security-wg.

ack

expectations of upcoming releases

That's somewhat unspecific. What does it mean?

from security-wg.

I acknowledge

from security-wg.

I acknowledge.

from security-wg.

from security-wg.

I acknowledge.

from security-wg.

I acknowledge.

from security-wg.

I acknowledge.

from security-wg.

I acknowledge.

from security-wg.

I acknowledge.

from security-wg.

ack

from security-wg.

I acknowledge as being an org owner. I do not have access to node-private.

from security-wg.

ack

from security-wg.

ack but I'd really like this wording to be amended to explicitly include the option to include outsiders as long as the private security groups agrees (in practice it'd be -- "I'd like to share with X, does anyone disagree?"). I can't say enough how hard it can be to get proper feedback on many security problems, their fixes and the handling process. There have been instances where having external help in reviewing or getting expert feedback has been essential. The security group is too small and not engaged enough right now and this restriction is just going to make it more difficult for the person trying to address a security concern and/or shepherding a fix out and will impact our ability to ensure quality fixes (we don't have a solid track record here, there are many instances of follow-up patches to our security fixes once the broader collaborator group gets to review).

from security-wg.

@rvagg sounds reasonable, if you could PR the additional working you think would make sense that would be great.

from security-wg.

Ack

from security-wg.

I think this is good to close at this point.

from security-wg.