4 ms·
OpenSSL recently passed a change in their vuln announcement policy to give a major firm, which everyone here knows I think, 7 days advance notice of any zero-da
by rshnotsecure 6y ago
OpenSSL recently passed a change in their vuln announcement policy to give a major firm, which everyone here knows I think, 7 days advance notice of any zero-day that they were made aware of.
This was the engineer who helped set up the new policy: https://awe.com https://awe.com
To be honest, maybe it's a good idea. It depends on how much support Huawei is willing to give OpenSSL.
- throw0101a 6y agoIn case anyone is curious: > The OMC voted this week to update our security policy [1] to include the option of us giving prenotification to companies with which we have a commercial relationship. (Edited to clarify: the vote was to allow notification to our Premium Support customers and this does not include lower support levels, sponsors, or GitHub sponsors.) * https://www.openssl.org/blog/blog/2020/05/12/security-prenotifications/ https://www.openssl.org/blog/blog/2020/05/12/security-prenot... * https://www.openssl.org/support/contracts.html#premium https://www.openssl.org/support/contracts.html#premium
- marcinzm 6y agoSo, being realistic here, that means the Chinese government is given 7 days advance notice?
- blasdel 6y agohttps://xenproject.org/developers/security-policy/#organizations-on-the-pre-disclosure-list https://xenproject.org/developers/security-policy/#organizat...