Received: from localhost (maia-5.hub.org [200.46.204.182]) by postgresql.org (Postfix) with ESMTP id 0C4F09FA4D1 for ; Mon, 5 Feb 2007 17:03:22 -0400 (AST) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.182]) (amavisd-new, port 10024) with ESMTP id 66225-03 for ; Mon, 5 Feb 2007 17:03:15 -0400 (AST) X-Greylist: from auto-whitelisted by SQLgrey-1.7.4 Received: from fetter.org (start.fetter.org [66.92.188.65]) by postgresql.org (Postfix) with ESMTP id E3B689FA134 for ; Mon, 5 Feb 2007 17:03:17 -0400 (AST) Received: by fetter.org (Postfix, from userid 500) id 1BAE7F3D19C; Mon, 5 Feb 2007 13:03:16 -0800 (PST) Date: Mon, 5 Feb 2007 13:03:15 -0800 From: David Fetter To: Josh Berkus Cc: pgsql-www@postgresql.org Subject: Re: How to coordinate web team for security releases? Message-ID: <20070205210315.GA7988@fetter.org> References: <200702051128.13819.josh@agliodbs.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200702051128.13819.josh@agliodbs.com> User-Agent: Mutt/1.4.2.1i X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200702/44 X-Sequence-Number: 11449 On Mon, Feb 05, 2007 at 11:28:13AM -0800, Josh Berkus wrote: > WWW core team, > > I need a way to coordinate with you around preparing postgresql.org > for upcoming releases, especially for security releases where it's > critical that the timing be tight. Due to some issues with this > last release, pgsql-www obviously isn't the right venue. I think we need to separate this into two issues: 1. Publishing vulnerabilities only after we've distributed the fix, and 2. Publishing the fact that a minor point release is on its way in order that organizations be able to schedule upgrades. I see these as separable announcements, with what appear to be opposing motivations. For getting upgrades in the pipeline, sooner is better than later. Quite a few outfits have processes that take two weeks or more before the upgrade actually goes through. Giving them a heads-up on this is a good thing, and serious users know that we don't do minor point releases for the sheer thrills of it, i.e. just knowing that something is coming is enough reason for them to schedule the aforementioned upgrade. For vulns, it's really a Good Idea to let as little about them as possible get out in advance of the fix. It's this part that is sensitive information. So here's my proposal. As soon as we have a pretty good idea of when we are going to do a minor point release, we should let the public know with a generic, "Point releases coming. Get ready to upgrade" kind of message. When we find and characterize vulns, we put out at least the severity on some specific private list--which one is TBD--when known so mirrors, packagers, etc. can make it a priority to make those updates available ASAP. As far as the details of vulns, those should only get published as part of the post-distribution announcement. Cheers, D -- David Fetter http://fetter.org/ phone: +1 415 235 3778 AIM: dfetter666 Skype: davidfetter Remember to vote!