From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-in5.apple.com (mail-out5.apple.com [17.151.62.27]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 91D7E1A1E12 for ; Tue, 2 Aug 2016 13:56:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=apple.com; s=mailout2048s; c=relaxed/simple; q=dns/txt; i=@apple.com; t=1470171371; x=2334084971; h=From:Sender:Reply-To:Subject:Date:Message-id:To:Cc:MIME-version:Content-type: Content-transfer-encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-reply-to:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=cTGaZBPityeBlP+nK+Y4t0T28Q6ysmq6Hf/miFBKkzU=; b=oJvi3IpRT6Pu16iZGRSxN1KsGu5Pa9mxIlv0kip0jg0KYEmoGS2F3yvq3eNjKTIE d51pNVpJbKEup+RSVlygKfxV2KQrO833fDnqWUZqzmOwnjJTWF/AV0/CkeoMIO68 zfd7kMEwNuujrgl5wFPLHsZmhg+n47nrRTSDc5p5Jk7vDbFaIU1EmacrFCqu5GzJ 51dHdJtqEVaPlppbHN49pIpoIv3gOzQvP5danT+vGYGGNHy8D6yql2L3olFJ/mbs Q4tJbhtsYNHjVrbP+ke9gztxesDfek4PSyJj5dQG97jxzR1MMSTmDi3RPjLemg95 B67776IVWvXXAo6/HSrsBw==; Received: from relay6.apple.com (relay6.apple.com [17.128.113.90]) by mail-in5.apple.com (Apple Secure Mail Relay) with SMTP id F4.E4.07273.BE801A75; Tue, 2 Aug 2016 13:56:11 -0700 (PDT) X-AuditID: 11973e13-f794a6d000001c69-4f-57a108eb2945 Received: from nwk-mmpp-sz13.apple.com (nwk-mmpp-sz13.apple.com [17.128.115.216]) by relay6.apple.com (Apple SCV relay) with SMTP id C9.76.31551.BE801A75; Tue, 2 Aug 2016 13:56:11 -0700 (PDT) MIME-version: 1.0 Received: from [17.114.155.95] (unknown [17.114.155.95]) by nwk-mmpp-sz13.apple.com (Oracle Communications Messaging Server 8.0.1.1.0 64bit (built Jun 15 2016)) with ESMTPSA id <0OBA002WNVHME460@nwk-mmpp-sz13.apple.com>; Tue, 02 Aug 2016 13:56:11 -0700 (PDT) Sender: afish@apple.com From: Andrew Fish In-reply-to: Date: Tue, 02 Aug 2016 13:56:25 -0700 Cc: Laszlo Ersek , Mike Kinney , edk2-devel-01 Message-id: <7F078452-C0E2-40CA-A1C3-D7AABAB2A7B0@apple.com> References: <79672ab9-15b9-a44e-f37a-313093489d9b@redhat.com> <52fe8d21-7c6c-3b48-e336-30042a6fae8f@redhat.com> <15ba9a6e-c793-4e22-3f38-cc95c34b0ff0@redhat.com> To: Michael Zimmermann X-Mailer: Apple Mail (2.3112) X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFrrNLMWRmVeSWpSXmKPExsUi2FAYpfuaY2G4wckrlhbr9nxjt1h2bAeL RUfHPyaLuVOfsjqweOycdZfdY/Gel0weky48ZvZ4v+8qWwBLFJdNSmpOZllqkb5dAlfG6Wmn GQtalCr+71/I2MA4W7qLkZNDQsBEouHUTHYIW0ziwr31bF2MXBxCAnsZJfrnr2WCKTrwZS9U 4hCjxL5v/8ESvAKCEj8m32PpYuTgYBaQlzh4XhYkzCygJfH9USsLiC0k0MUkMXmqK4gtLCAu 8e7MJmYI21Ji2qILbCA2m4CyxIr5H8CO4BQIlni64DiYzSKgKvFw9lo2iJkVEh0brrJDrLWR WL2rmxHinn42iak37oENFREwlHja/BjqaFmJfRsWgB0tIXCZTWLBqqtMExhFZiG5exbC3bOQ 3L2AkXkVo1BuYmaObmaeqV5iQUFOql5yfu4mRlBsTLcT3sF4epXVIUYBDkYlHl7L8wvChVgT y4orcw8xSnOwKInz+p0CCgmkJ5akZqemFqQWxReV5qQWH2Jk4uCUamCM/hi44nFYg88Gvw7D nfMsdrpaZ4c0Miw3Nn9iraYXtiel1KamfH9/nHrrOV6FLX5NW57E2HBe2Joya4/9egHLG/an T3dO81r9P/SDF8e7yivcub2dlecvT7e975J46kS6S+Ebv+LY8IwlbyO/a7/Qj4uZ3/75xZ1H Hzv2rxS9kl8syn3cS12JpTgj0VCLuag4EQBUm14PbgIAAA== X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFprGIsWRmVeSWpSXmKPExsUi2FB8Q/c1x8Jwg9uzDCzW7fnGbrHs2A4W i46Of0wWc6c+ZXVg8dg56y67x+I9L5k8Jl14zOzxft9VtgCWKC6blNSczLLUIn27BK6M09NO Mxa0KFX837+QsYFxtnQXIyeHhICJxIEve9kgbDGJC/fWA9lcHEIChxgl9n37zwSS4BUQlPgx +R5LFyMHB7OAvMTB87IgYWYBLYnvj1pZQGwhgS4miclTXUFsYQFxiXdnNjFD2JYS0xZdAJvP JqAssWL+B3YQm1MgWOLpguNgNouAqsTD2WvZIGZWSHRsuMoOsdZGYvWubkaIe/rZJKbeuAc2 VETAUOJp82MmiKNlJfZtWMA2gVFwFpJTZyGcOgvJqQsYmVcxChSl5iRWmuklFhTkpOol5+du YgSHcmHUDsaG5VaHGAU4GJV4eC3OLwgXYk0sK67MBYYFB7OSCC8Xy8JwId6UxMqq1KL8+KLS nNTiQ4zJQA9MZJYSTc4HxlleSbyhiYmBibGxmbGxuYk5acJK4rwJx+eHCwmkJ5akZqemFqQW wWxh4uCUamCUZc+d+TXrmuazOJO/Nyou3TapF8yQmNEp5JLwLPXNht06cRpzrv2Lej83Orax 5VvSybdyv60r32Ur3Wf7KOvSlOu892hL5q8Jd11sp167rfVmydTrfCnPb026m184u6nNuXlO 3CK1lq2eqTq2Ooyq/YvCU9sZLyh+7a+U8270LKmefOBYxCwlluKMREMt5qLiRACb6rZtqQIA AA== Subject: Re: Tianocore Bugzilla Server is now live X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Aug 2016 20:56:12 -0000 Content-transfer-encoding: 7BIT Content-type: text/plain; CHARSET=US-ASCII > On Aug 2, 2016, at 12:43 PM, Michael Zimmermann wrote: > > How are security issues treated in UEFI anyway? They follow the standard ethical disclosure process like then one discussed here: http://www.uefi.org/security > Are they kept a secret forever or just for a specific time span? > The ethical disclosure processes is followed and an timespan is picked that lets systems that are going to get updates get fixed. This is how things security work in general. > A reason for keeping them a secret forever(while pushing > unsuspicious fixes) probably would be the fact that most UEFI systems don't > get updated. > No after some reasonable amount of time there will be disclosure to the public. The embargo of information is to let as many folks as possible get patches in place before the issue is public. Thanks, Andrew Fish > Thanks > Michael > > On Tue, Aug 2, 2016 at 9:34 PM, Laszlo Ersek wrote: > >> On 08/02/16 21:10, Kinney, Michael D wrote: >>> Michael, >>> >>> I am open to suggestions on this topic. >>> >>> If there is a strong opinion that we need to protect specific fields >>> from being modified, then we can look into updating the configuration. >>> >>> I think with Bugzilla change history and edk2-bugs mailing list, we can >>> all see the changes to any issue, so even if someone does do an >>> incorrect edit, I think we can put it back. >> >> Does "editbugs" include changing the product from "Tianocore Security >> Issues" to something else, possibly exposing the security issue to the >> world? >> >> Hm... It probably doesn't matter. If a security issue can be looked at >> (which is a pre-requisite for the product field to be changed) by anyone >> in the first place, then they can expose the contents to the world in >> other ways too. :) >> >> So I think trusting all registered accounts with "editbugs" is a good >> starting point too. >> >> Thanks >> Laszlo >> >> >>> *From:*Michael Zimmermann [mailto:sigmaepsilon92@gmail.com] >>> *Sent:* Tuesday, August 2, 2016 11:57 AM >>> *To:* Laszlo Ersek >>> *Cc:* Kinney, Michael D ; edk2-devel-01 >>> >>> *Subject:* Re: [edk2] Tianocore Bugzilla Server is now live >>> >>> >>> >>> Is it just my account or does everybody have the permission >>> "editbugs Can edit all bug fields"? >>> >>> >>> >>> It sounds like this is something only moderators should be able to do. >>> >>> >>> >>> Thanks >>> >>> Michael >>> >>> >>> >>> On Thu, Jul 21, 2016 at 8:43 PM, Laszlo Ersek >> > wrote: >>> >>> On 07/21/16 20:07, Kinney, Michael D wrote: >>>> Laszlo, >>>> >>>> Try again...it was disabled for a short period of time. >>> >>> Yes, it's working now. >>> >>> I'll let you know when I'm done with the clipboard "wizardry" and the >>> occasional reformatting :) >>> >>> Thanks! >>> Laszlo >>> >>>>> -----Original Message----- >>>>> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org >>> ] On Behalf Of Laszlo Ersek >>>>> Sent: Thursday, July 21, 2016 10:33 AM >>>>> To: Kinney, Michael D > michael.d.kinney@intel.com>> >>>>> Cc: edk2-devel-01 > edk2-devel@ml01.01.org>> >>>>> Subject: Re: [edk2] Tianocore Bugzilla Server is now live >>>>> >>>>> On 07/21/16 19:05, Kinney, Michael D wrote: >>>>>> Laszlo, >>>>>> >>>>>> Yes. We can hold off disabling GitHub. Let us know when you >> are ready. >>>>> >>>>> Thank you! However, github is rejecting my new comments in the >> browser >>>>> tabs that I have open already, and it rejects my fresh requests >> for >>>>> issue URLs. >>>>> >>>>> Thanks, >>>>> Laszlo >>> >>> _______________________________________________ >>> edk2-devel mailing list >>> edk2-devel@lists.01.org >>> https://lists.01.org/mailman/listinfo/edk2-devel >>> >>> >>> >> >> > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel