Subject: Re: Security information page
From: Simon Riggs <simon@2ndquadrant.com>
To: Magnus Hagander <mha@sollentuna.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, pgsql-www@postgresql.org
In-Reply-To: <6BCB9D8A16AC4241919521715F4D8BCE92E8B0@algol.sollentuna.se>
References: <6BCB9D8A16AC4241919521715F4D8BCE92E8B0@algol.sollentuna.se>
Content-Type: text/plain
Date: Sun, 27 Nov 2005 22:51:05 +0000
Message-Id: <1133131865.2906.234.camel@localhost.localdomain>
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit

On Sun, 2005-11-27 at 21:52 +0100, Magnus Hagander wrote:
..Tom Lane wrote
> > I think the bit about "Our goal is to gain and maintain 
> > CVE-compatible status" is bogus.  As near as I can tell, 
> > Mitre's definition of CVE compatibility applies to security 
> > products (eg, vulnerability scanners) which Postgres is not.  
> 
> Um. Not really - products like Debian are CVE compatible
> (http://www.us.debian.org/security/cve-compatibility), so it's not just
> for security products.
> 
> > You could maybe say that this one web page is something that 
> > could apply for CVE compatibility status, but are we going to 
> > jump through those hoops for one web page?  Nyet.
> 
> Right. I'll take that off until such a time as we're further along that
> process (see Simons mails).

I'll re-raise this as a separate item, later; one step at a time.

> Looks better now?

And the first step looks very good now.

Best Regards, Simon Riggs