On Sat, Apr 16, 2011 at 9:23 AM, Nick Coghlan <ncogh...@gmail.com> wrote: > On Sat, Apr 16, 2011 at 9:45 PM, Gustavo Narea <m...@gustavonarea.net> wrote: >> May I suggest that you adopt a policy for handling security issues like >> Django's? >> http://docs.djangoproject.com/en/1.3/internals/contributing/#reporting-security-issues > > When the list of people potentially using the software is "anyone > running Linux or Mac OS X and an awful lot of people running Windows > or an embedded device", private pre-announcements simply aren't a > practical reality. Neither is "stopping all other development" when > most of the core development team aren't on the secur...@python.org > list and don't even know a security issue exists until it is announced > publicly. Take those two impractical steps out of the process, and > what you have *is* the python.org procedure for dealing with security > issues.
Just to fill in a bit of missing detail about our process since the doc doesn't perfectly describe what happens: * Our pre-announce list is *really* short. It consists of release managers for various distributions that distribute packaged versions of Django -- Ubuntu, RedHat, and the like. Yes it's a bit of bookkeeping, but we feel it's really important to our users: not everyone installs the Django package *we* put out, so we think it's important to coordinate security releases with downstream distributors so that users get a fixed version of Django regardless of how they're installing Django in the first place. * We don't really halt all development. I don't know why that's in there, except maybe that it pre-dates there being more than a couple-three committers. The point is just that we treat the security issue as our most important issue at the moment and fix it as quickly as possible. I don't really have a point here as it pertains to python-dev, but I thought it's important to clarify what Django *actually* does if it's being discussed as a model. Jacob _______________________________________________ Python-Dev mailing list Python-Dev@python.org http://mail.python.org/mailman/listinfo/python-dev Unsubscribe: http://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com