* Re: Tianocore Bugzilla Server is now live [not found] ` <15ba9a6e-c793-4e22-3f38-cc95c34b0ff0@redhat.com> @ 2016-08-02 18:57 ` Michael Zimmermann 2016-08-02 19:10 ` Kinney, Michael D 2016-08-02 19:15 ` Laszlo Ersek 0 siblings, 2 replies; 6+ messages in thread From: Michael Zimmermann @ 2016-08-02 18:57 UTC (permalink / raw) To: Laszlo Ersek; +Cc: Kinney, Michael D, edk2-devel-01 Is it just my account or does everybody have the permission "editbugs Can edit all bug fields"? It sounds like this is something only moderators should be able to do. Thanks Michael On Thu, Jul 21, 2016 at 8:43 PM, Laszlo Ersek <lersek@redhat.com> wrote: > On 07/21/16 20:07, Kinney, Michael D wrote: > > Laszlo, > > > > Try again...it was disabled for a short period of time. > > Yes, it's working now. > > I'll let you know when I'm done with the clipboard "wizardry" and the > occasional reformatting :) > > Thanks! > Laszlo > > >> -----Original Message----- > >> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org] On Behalf Of > Laszlo Ersek > >> Sent: Thursday, July 21, 2016 10:33 AM > >> To: Kinney, Michael D <michael.d.kinney@intel.com> > >> Cc: edk2-devel-01 <edk2-devel@ml01.01.org> > >> Subject: Re: [edk2] Tianocore Bugzilla Server is now live > >> > >> On 07/21/16 19:05, Kinney, Michael D wrote: > >>> Laszlo, > >>> > >>> Yes. We can hold off disabling GitHub. Let us know when you are > ready. > >> > >> Thank you! However, github is rejecting my new comments in the browser > >> tabs that I have open already, and it rejects my fresh requests for > >> issue URLs. > >> > >> Thanks, > >> Laszlo > > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Tianocore Bugzilla Server is now live 2016-08-02 18:57 ` Tianocore Bugzilla Server is now live Michael Zimmermann @ 2016-08-02 19:10 ` Kinney, Michael D 2016-08-02 19:34 ` Laszlo Ersek 2016-08-02 19:15 ` Laszlo Ersek 1 sibling, 1 reply; 6+ messages in thread From: Kinney, Michael D @ 2016-08-02 19:10 UTC (permalink / raw) To: Michael Zimmermann, Laszlo Ersek, Kinney, Michael D; +Cc: edk2-devel-01 Michael, I am open to suggestions on this topic. If there is a strong opinion that we need to protect specific fields from being modified, then we can look into updating the configuration. I think with Bugzilla change history and edk2-bugs mailing list, we can all see the changes to any issue, so even if someone does do an incorrect edit, I think we can put it back. Mike From: Michael Zimmermann [mailto:sigmaepsilon92@gmail.com] Sent: Tuesday, August 2, 2016 11:57 AM To: Laszlo Ersek <lersek@redhat.com> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; edk2-devel-01 <edk2-devel@ml01.01.org> Subject: Re: [edk2] Tianocore Bugzilla Server is now live Is it just my account or does everybody have the permission "editbugs Can edit all bug fields"? It sounds like this is something only moderators should be able to do. Thanks Michael On Thu, Jul 21, 2016 at 8:43 PM, Laszlo Ersek <lersek@redhat.com<mailto:lersek@redhat.com>> wrote: On 07/21/16 20:07, Kinney, Michael D wrote: > Laszlo, > > Try again...it was disabled for a short period of time. Yes, it's working now. I'll let you know when I'm done with the clipboard "wizardry" and the occasional reformatting :) Thanks! Laszlo >> -----Original Message----- >> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org<mailto:edk2-devel-bounces@lists.01.org>] On Behalf Of Laszlo Ersek >> Sent: Thursday, July 21, 2016 10:33 AM >> To: Kinney, Michael D <michael.d.kinney@intel.com<mailto:michael.d.kinney@intel.com>> >> Cc: edk2-devel-01 <edk2-devel@ml01.01.org<mailto:edk2-devel@ml01.01.org>> >> Subject: Re: [edk2] Tianocore Bugzilla Server is now live >> >> On 07/21/16 19:05, Kinney, Michael D wrote: >>> Laszlo, >>> >>> Yes. We can hold off disabling GitHub. Let us know when you are ready. >> >> Thank you! However, github is rejecting my new comments in the browser >> tabs that I have open already, and it rejects my fresh requests for >> issue URLs. >> >> Thanks, >> Laszlo _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org<mailto:edk2-devel@lists.01.org> https://lists.01.org/mailman/listinfo/edk2-devel ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Tianocore Bugzilla Server is now live 2016-08-02 19:10 ` Kinney, Michael D @ 2016-08-02 19:34 ` Laszlo Ersek 2016-08-02 19:43 ` Michael Zimmermann 0 siblings, 1 reply; 6+ messages in thread From: Laszlo Ersek @ 2016-08-02 19:34 UTC (permalink / raw) To: Kinney, Michael D, Michael Zimmermann; +Cc: edk2-devel-01 On 08/02/16 21:10, Kinney, Michael D wrote: > Michael, > > I am open to suggestions on this topic. > > If there is a strong opinion that we need to protect specific fields > from being modified, then we can look into updating the configuration. > > I think with Bugzilla change history and edk2-bugs mailing list, we can > all see the changes to any issue, so even if someone does do an > incorrect edit, I think we can put it back. Does "editbugs" include changing the product from "Tianocore Security Issues" to something else, possibly exposing the security issue to the world? Hm... It probably doesn't matter. If a security issue can be looked at (which is a pre-requisite for the product field to be changed) by anyone in the first place, then they can expose the contents to the world in other ways too. :) So I think trusting all registered accounts with "editbugs" is a good starting point too. Thanks Laszlo > *From:*Michael Zimmermann [mailto:sigmaepsilon92@gmail.com] > *Sent:* Tuesday, August 2, 2016 11:57 AM > *To:* Laszlo Ersek <lersek@redhat.com> > *Cc:* Kinney, Michael D <michael.d.kinney@intel.com>; edk2-devel-01 > <edk2-devel@ml01.01.org> > *Subject:* Re: [edk2] Tianocore Bugzilla Server is now live > > > > Is it just my account or does everybody have the permission > "editbugs Can edit all bug fields"? > > > > It sounds like this is something only moderators should be able to do. > > > > Thanks > > Michael > > > > On Thu, Jul 21, 2016 at 8:43 PM, Laszlo Ersek <lersek@redhat.com > <mailto:lersek@redhat.com>> wrote: > > On 07/21/16 20:07, Kinney, Michael D wrote: > > Laszlo, > > > > Try again...it was disabled for a short period of time. > > Yes, it's working now. > > I'll let you know when I'm done with the clipboard "wizardry" and the > occasional reformatting :) > > Thanks! > Laszlo > > >> -----Original Message----- > >> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org > <mailto:edk2-devel-bounces@lists.01.org>] On Behalf Of Laszlo Ersek > >> Sent: Thursday, July 21, 2016 10:33 AM > >> To: Kinney, Michael D <michael.d.kinney@intel.com <mailto:michael.d.kinney@intel.com>> > >> Cc: edk2-devel-01 <edk2-devel@ml01.01.org <mailto:edk2-devel@ml01.01.org>> > >> Subject: Re: [edk2] Tianocore Bugzilla Server is now live > >> > >> On 07/21/16 19:05, Kinney, Michael D wrote: > >>> Laszlo, > >>> > >>> Yes. We can hold off disabling GitHub. Let us know when you are ready. > >> > >> Thank you! However, github is rejecting my new comments in the browser > >> tabs that I have open already, and it rejects my fresh requests for > >> issue URLs. > >> > >> Thanks, > >> Laszlo > > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org <mailto:edk2-devel@lists.01.org> > https://lists.01.org/mailman/listinfo/edk2-devel > > > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Tianocore Bugzilla Server is now live 2016-08-02 19:34 ` Laszlo Ersek @ 2016-08-02 19:43 ` Michael Zimmermann 2016-08-02 20:56 ` Andrew Fish 0 siblings, 1 reply; 6+ messages in thread From: Michael Zimmermann @ 2016-08-02 19:43 UTC (permalink / raw) To: Laszlo Ersek; +Cc: Kinney, Michael D, edk2-devel-01 How are security issues treated in UEFI anyway? Are they kept a secret forever or just for a specific time span? A reason for keeping them a secret forever(while pushing unsuspicious fixes) probably would be the fact that most UEFI systems don't get updated. Thanks Michael On Tue, Aug 2, 2016 at 9:34 PM, Laszlo Ersek <lersek@redhat.com> wrote: > On 08/02/16 21:10, Kinney, Michael D wrote: > > Michael, > > > > I am open to suggestions on this topic. > > > > If there is a strong opinion that we need to protect specific fields > > from being modified, then we can look into updating the configuration. > > > > I think with Bugzilla change history and edk2-bugs mailing list, we can > > all see the changes to any issue, so even if someone does do an > > incorrect edit, I think we can put it back. > > Does "editbugs" include changing the product from "Tianocore Security > Issues" to something else, possibly exposing the security issue to the > world? > > Hm... It probably doesn't matter. If a security issue can be looked at > (which is a pre-requisite for the product field to be changed) by anyone > in the first place, then they can expose the contents to the world in > other ways too. :) > > So I think trusting all registered accounts with "editbugs" is a good > starting point too. > > Thanks > Laszlo > > > > *From:*Michael Zimmermann [mailto:sigmaepsilon92@gmail.com] > > *Sent:* Tuesday, August 2, 2016 11:57 AM > > *To:* Laszlo Ersek <lersek@redhat.com> > > *Cc:* Kinney, Michael D <michael.d.kinney@intel.com>; edk2-devel-01 > > <edk2-devel@ml01.01.org> > > *Subject:* Re: [edk2] Tianocore Bugzilla Server is now live > > > > > > > > Is it just my account or does everybody have the permission > > "editbugs Can edit all bug fields"? > > > > > > > > It sounds like this is something only moderators should be able to do. > > > > > > > > Thanks > > > > Michael > > > > > > > > On Thu, Jul 21, 2016 at 8:43 PM, Laszlo Ersek <lersek@redhat.com > > <mailto:lersek@redhat.com>> wrote: > > > > On 07/21/16 20:07, Kinney, Michael D wrote: > > > Laszlo, > > > > > > Try again...it was disabled for a short period of time. > > > > Yes, it's working now. > > > > I'll let you know when I'm done with the clipboard "wizardry" and the > > occasional reformatting :) > > > > Thanks! > > Laszlo > > > > >> -----Original Message----- > > >> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org > > <mailto:edk2-devel-bounces@lists.01.org>] On Behalf Of Laszlo Ersek > > >> Sent: Thursday, July 21, 2016 10:33 AM > > >> To: Kinney, Michael D <michael.d.kinney@intel.com <mailto: > michael.d.kinney@intel.com>> > > >> Cc: edk2-devel-01 <edk2-devel@ml01.01.org <mailto: > edk2-devel@ml01.01.org>> > > >> Subject: Re: [edk2] Tianocore Bugzilla Server is now live > > >> > > >> On 07/21/16 19:05, Kinney, Michael D wrote: > > >>> Laszlo, > > >>> > > >>> Yes. We can hold off disabling GitHub. Let us know when you > are ready. > > >> > > >> Thank you! However, github is rejecting my new comments in the > browser > > >> tabs that I have open already, and it rejects my fresh requests > for > > >> issue URLs. > > >> > > >> Thanks, > > >> Laszlo > > > > _______________________________________________ > > edk2-devel mailing list > > edk2-devel@lists.01.org <mailto:edk2-devel@lists.01.org> > > https://lists.01.org/mailman/listinfo/edk2-devel > > > > > > > > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Tianocore Bugzilla Server is now live 2016-08-02 19:43 ` Michael Zimmermann @ 2016-08-02 20:56 ` Andrew Fish 0 siblings, 0 replies; 6+ messages in thread From: Andrew Fish @ 2016-08-02 20:56 UTC (permalink / raw) To: Michael Zimmermann; +Cc: Laszlo Ersek, Mike Kinney, edk2-devel-01 > On Aug 2, 2016, at 12:43 PM, Michael Zimmermann <sigmaepsilon92@gmail.com> wrote: > > How are security issues treated in UEFI anyway? They follow the standard ethical disclosure process like then one discussed here: http://www.uefi.org/security > Are they kept a secret forever or just for a specific time span? > The ethical disclosure processes is followed and an timespan is picked that lets systems that are going to get updates get fixed. This is how things security work in general. > A reason for keeping them a secret forever(while pushing > unsuspicious fixes) probably would be the fact that most UEFI systems don't > get updated. > No after some reasonable amount of time there will be disclosure to the public. The embargo of information is to let as many folks as possible get patches in place before the issue is public. Thanks, Andrew Fish > Thanks > Michael > > On Tue, Aug 2, 2016 at 9:34 PM, Laszlo Ersek <lersek@redhat.com> wrote: > >> On 08/02/16 21:10, Kinney, Michael D wrote: >>> Michael, >>> >>> I am open to suggestions on this topic. >>> >>> If there is a strong opinion that we need to protect specific fields >>> from being modified, then we can look into updating the configuration. >>> >>> I think with Bugzilla change history and edk2-bugs mailing list, we can >>> all see the changes to any issue, so even if someone does do an >>> incorrect edit, I think we can put it back. >> >> Does "editbugs" include changing the product from "Tianocore Security >> Issues" to something else, possibly exposing the security issue to the >> world? >> >> Hm... It probably doesn't matter. If a security issue can be looked at >> (which is a pre-requisite for the product field to be changed) by anyone >> in the first place, then they can expose the contents to the world in >> other ways too. :) >> >> So I think trusting all registered accounts with "editbugs" is a good >> starting point too. >> >> Thanks >> Laszlo >> >> >>> *From:*Michael Zimmermann [mailto:sigmaepsilon92@gmail.com] >>> *Sent:* Tuesday, August 2, 2016 11:57 AM >>> *To:* Laszlo Ersek <lersek@redhat.com> >>> *Cc:* Kinney, Michael D <michael.d.kinney@intel.com>; edk2-devel-01 >>> <edk2-devel@ml01.01.org> >>> *Subject:* Re: [edk2] Tianocore Bugzilla Server is now live >>> >>> >>> >>> Is it just my account or does everybody have the permission >>> "editbugs Can edit all bug fields"? >>> >>> >>> >>> It sounds like this is something only moderators should be able to do. >>> >>> >>> >>> Thanks >>> >>> Michael >>> >>> >>> >>> On Thu, Jul 21, 2016 at 8:43 PM, Laszlo Ersek <lersek@redhat.com >>> <mailto:lersek@redhat.com>> wrote: >>> >>> On 07/21/16 20:07, Kinney, Michael D wrote: >>>> Laszlo, >>>> >>>> Try again...it was disabled for a short period of time. >>> >>> Yes, it's working now. >>> >>> I'll let you know when I'm done with the clipboard "wizardry" and the >>> occasional reformatting :) >>> >>> Thanks! >>> Laszlo >>> >>>>> -----Original Message----- >>>>> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org >>> <mailto:edk2-devel-bounces@lists.01.org>] On Behalf Of Laszlo Ersek >>>>> Sent: Thursday, July 21, 2016 10:33 AM >>>>> To: Kinney, Michael D <michael.d.kinney@intel.com <mailto: >> michael.d.kinney@intel.com>> >>>>> Cc: edk2-devel-01 <edk2-devel@ml01.01.org <mailto: >> edk2-devel@ml01.01.org>> >>>>> Subject: Re: [edk2] Tianocore Bugzilla Server is now live >>>>> >>>>> On 07/21/16 19:05, Kinney, Michael D wrote: >>>>>> Laszlo, >>>>>> >>>>>> Yes. We can hold off disabling GitHub. Let us know when you >> are ready. >>>>> >>>>> Thank you! However, github is rejecting my new comments in the >> browser >>>>> tabs that I have open already, and it rejects my fresh requests >> for >>>>> issue URLs. >>>>> >>>>> Thanks, >>>>> Laszlo >>> >>> _______________________________________________ >>> edk2-devel mailing list >>> edk2-devel@lists.01.org <mailto:edk2-devel@lists.01.org> >>> https://lists.01.org/mailman/listinfo/edk2-devel >>> >>> >>> >> >> > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: Tianocore Bugzilla Server is now live 2016-08-02 18:57 ` Tianocore Bugzilla Server is now live Michael Zimmermann 2016-08-02 19:10 ` Kinney, Michael D @ 2016-08-02 19:15 ` Laszlo Ersek 1 sibling, 0 replies; 6+ messages in thread From: Laszlo Ersek @ 2016-08-02 19:15 UTC (permalink / raw) To: Michael Zimmermann; +Cc: Kinney, Michael D, edk2-devel-01 On 08/02/16 20:57, Michael Zimmermann wrote: > Is it just my account or does everybody have the permission "editbugsCan > edit all bug fields"? > > It sounds like this is something only moderators should be able to do. Indeed I noticed this permission when I last looked (in the "whine" thread). I think it might make sense to restrict this permission to package maintainers. And, I think "refinements" beyond that should not be necessary -- I for one certainly would like to be able to edit all bugzilla fields, regardless of their current values! :) Thanks Laszlo > > Thanks > Michael > > On Thu, Jul 21, 2016 at 8:43 PM, Laszlo Ersek <lersek@redhat.com > <mailto:lersek@redhat.com>> wrote: > > On 07/21/16 20:07, Kinney, Michael D wrote: > > Laszlo, > > > > Try again...it was disabled for a short period of time. > > Yes, it's working now. > > I'll let you know when I'm done with the clipboard "wizardry" and the > occasional reformatting :) > > Thanks! > Laszlo > > >> -----Original Message----- > >> From: edk2-devel [mailto:edk2-devel-bounces@lists.01.org > <mailto:edk2-devel-bounces@lists.01.org>] On Behalf Of Laszlo Ersek > >> Sent: Thursday, July 21, 2016 10:33 AM > >> To: Kinney, Michael D <michael.d.kinney@intel.com <mailto:michael.d.kinney@intel.com>> > >> Cc: edk2-devel-01 <edk2-devel@ml01.01.org <mailto:edk2-devel@ml01.01.org>> > >> Subject: Re: [edk2] Tianocore Bugzilla Server is now live > >> > >> On 07/21/16 19:05, Kinney, Michael D wrote: > >>> Laszlo, > >>> > >>> Yes. We can hold off disabling GitHub. Let us know when you are ready. > >> > >> Thank you! However, github is rejecting my new comments in the browser > >> tabs that I have open already, and it rejects my fresh requests for > >> issue URLs. > >> > >> Thanks, > >> Laszlo > > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org <mailto:edk2-devel@lists.01.org> > https://lists.01.org/mailman/listinfo/edk2-devel > > ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2016-08-02 20:56 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <E92EE9817A31E24EB0585FDF735412F5647E2C92@ORSMSX113.amr.corp.intel.com>
[not found] ` <79672ab9-15b9-a44e-f37a-313093489d9b@redhat.com>
[not found] ` <E92EE9817A31E24EB0585FDF735412F5647E32F6@ORSMSX113.amr.corp.intel.com>
[not found] ` <e22f28c1-ced1-5fd0-3a97-b923f0c42398@redhat.com>
[not found] ` <E92EE9817A31E24EB0585FDF735412F5647E364F@ORSMSX113.amr.corp.intel.com>
[not found] ` <52fe8d21-7c6c-3b48-e336-30042a6fae8f@redhat.com>
[not found] ` <E92EE9817A31E24EB0585FDF735412F5647E3784@ORSMSX113.amr.corp.intel.com>
[not found] ` <15ba9a6e-c793-4e22-3f38-cc95c34b0ff0@redhat.com>
2016-08-02 18:57 ` Tianocore Bugzilla Server is now live Michael Zimmermann
2016-08-02 19:10 ` Kinney, Michael D
2016-08-02 19:34 ` Laszlo Ersek
2016-08-02 19:43 ` Michael Zimmermann
2016-08-02 20:56 ` Andrew Fish
2016-08-02 19:15 ` Laszlo Ersek
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox