On Tue, 15 Sep 2009 09:58:31 +0200, Przemyslaw Frasunek <przemys...@frasunek.com> wrote: > Giorgos Keramidas wrote: >> Przemyslaw should email security-officer with any details he thinks are >> relevant. Then the security team will make sure to fix the bug for all >> affected releases of FreeBSD, release a patch with the fix, issue an >> advisory through the usual channels, and post the details online at our >> security information web pages at <http://www.FreeBSD.org/security/>. > > I see that I received a lot of criticism after disclosing 6.4 vulnerability. > Please read some facts: > > I send few mails: on 29th Aug to security team, on 2nd Sep and 11th Sep > directly > to security officer. None of them were responded. I haven't filled any PRs, > because it would disclose details of vulnerability to the public and allow > blackhats to exploit it. > > I won't publish anything more than video, before official security advisory. > The > exploit is private to me and it won't be given to the "community".
Hi Przemyslaw, What I wrote is not criticism for what you have or might have not done. I now know (after posting the initial message) that the security officer is preparing a fix and an advisory, so my response was more like ``this is the usual way of handling this sort of thing''. The wording was a bit careful to avoid implying that you didn't know or were not prepared to do what is appropriate :)
pgp6EjWT4Gvtk.pgp
Description: PGP signature
