Flaws drill holes in open-source databases

TalkBack 30 of 44:

Next »

« Previous

• Thread View
• Flat View

Thanks, it was as I suspected.

From your link:

Disclosure Timeline

02 May 2004 Subversion developers and vendor-sec were notified by email

03 May 2004 Subversion vendor started their own analysis of the issue and started compiling a list of big repositories to receive pre-notifications

11 May 2004 Big subversion repositories (not already contacted through vendor-sec) got pre-notified

19 May 2004 Coordinated Public Disclosure


If I read it right, they had 9 days where they knew about the problem before contacting the big repositories. They were very selective who they told. (Made a list of who gets the information and no one else.

And 17 days later decided to "coordinate" public discloser. Not that they did it, they coordinated. Does that mean they had no plan in place to release known bugs? From the wording I would assume so other wise there would be no need to "coordinate".

Again, the only point I am making is that they (as people demand of MS) warned admins the second they knew there was a problem. Anything else falls well short of being "open"...

Posted by: No_Ax_to_Grind   Posted on: 05/20/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• The True Costs of Virtual Server Solutions VMware In an economic environment that is repeatedly heralding the message "do ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Building the Virtualized Enterprise with VMware Iinfrastructure VMware VMware virtualization software has been adopted by over 120,000 enterprise ... Download Now