[DISCUSS][VOTE] CVE creation process

2022-01-03 Thread Ralph Goers
I would have recommended doing this vote by lazy consensus - i.e. you only need to vote if you object, since we have previously discussed this and no one seemed to object. Ralph > On Jan 3, 2022, at 4:59 AM, Volkan Yazıcı wrote: > > Hello, > > As discussed earlier[1], this is a vote to intro

[DISCUSS\[VOTE] CVE creation process

2022-01-03 Thread Ralph Goers
These are two really good questions! The 72 hours is recommended due to people being spread around the world and people being unavailable due to pressing $dayjob or family items, weekends, etc. But in an emergency the voting period can be compressed. This PMC has done a remarkably good job of

[DISCUSS][VOTE] CVE creation process

2022-01-03 Thread Ralph Goers
While you may think they are just investigating the vulnerability there really is a lot more that goes on behind the scenes. I know the second or third CVE we addressed took several days for me to be able to confirm it was actually a vulnerability. I was quite surprised that the DNS system does

Re: [DISCUSS][VOTE] CVE creation process

2022-01-03 Thread Matt Sicker
Lazy approval is the technical term for the voting style you’re describing. Lazy consensus is how committers and PMC members are voted on. Snippet: * Lazy consensus requires 3 binding +1 votes and no binding vetoes. * A lazy majority vote requires 3 binding +1 votes and more binding +1 votes tha