You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Joe Orton <jo...@redhat.com> on 2026/05/08 11:31:29 UTC
[VOTE] commit Low/Moderate severity security issues to public repos
Hi all, another vote -
We currently track all security issues in private, pushing these to the
public repos only during the preparation for a release. This adds
significant overhead for committers handling the current surge of
reports - a surge which mostly comprises Low severity issues. It also
delays us getting CI runs, which potentially delays the release, exactly
as happened with the recent mod_auth_digest fix in 2.4.67.
I'm proposing that we change the process: once we confirm a Low (and
maybe Moderate) severity issue, the fix can be pushed to the public
repos like any other change, with a deliberately obfuscated commit
message to conceal the security impact. The ASF Security team is fine
with this approach per [1], though cautions us to not keep the obscured
commits public for too long before a release.
Please vote:
[ ] No - keep the current process
[ ] Yes - push Low severity issues as obfuscated public commits
[ ] Yes - push Low+Moderate severity issues as obfuscated public commits
If you're fine with either Low or Low+Moderate vote "Yes" on both and
we'll see where the majority lies?
Regards, Joe
[1] https://cwiki.apache.org/confluence/display/SECURITY/Working+In+Private
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by jean-frederic clere <jf...@gmail.com>.
On 5/8/26 1:31 PM, Joe Orton wrote:
> Hi all, another vote -
>
> We currently track all security issues in private, pushing these to the
> public repos only during the preparation for a release. This adds
> significant overhead for committers handling the current surge of
> reports - a surge which mostly comprises Low severity issues. It also
> delays us getting CI runs, which potentially delays the release, exactly
> as happened with the recent mod_auth_digest fix in 2.4.67.
In Tomcat we also add: "This was fixed with commit commit_id" so it can
be checked by anyone but we don't change the commit messages.
>
> I'm proposing that we change the process: once we confirm a Low (and
> maybe Moderate) severity issue, the fix can be pushed to the public
> repos like any other change, with a deliberately obfuscated commit
> message to conceal the security impact. The ASF Security team is fine
> with this approach per [1], though cautions us to not keep the obscured
> commits public for too long before a release.
>
> Please vote:
>
> [ ] No - keep the current process
> [ ] Yes - push Low severity issues as obfuscated public commits
> [X] Yes - push Low+Moderate severity issues as obfuscated public commits
My vote ;-)
>
> If you're fine with either Low or Low+Moderate vote "Yes" on both and
> we'll see where the majority lies?
>
> Regards, Joe
>
> [1] https://cwiki.apache.org/confluence/display/SECURITY/Working+In+Private
>
--
Cheers
Jean-Frederic
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Frank Gingras <th...@apache.org>.
On Sat, May 9, 2026 at 9:10 AM Peter <pe...@gmail.com> wrote:
> Why am I getting these emails?
>
> Please explain what this email is saying basically.
>
> How did you get my info?
>
> On Fri, 8 May 2026, 13:47 Steffen, <in...@apachelounge.com> wrote:
>
>> Please vote:
>>
>>
>> [ ] No - keep the current process
>>
>> [ ] Yes - push Low severity issues as obfuscated public commits
>>
>> [ X] Yes - push Low+Moderate severity issues as obfuscated public commits
>>
>> Op 8 mei 2026 om 14:37 heeft Rainer Jung <ra...@kippdata.de> het
>> volgende geschreven:
>>
>> Am 08.05.26 um 14:27 schrieb Steffen:
>> > Sorry can you explain obfuscated. Translate to Dutch makes no sense.
>> See attachment.
>>
>> It might be "verhullen".
>>
>> Meaning (as Joe already wrote) we do not mention the security impact in
>> the original commit message, only the local change without too much detail.
>>
>>
Peter, you subscribed to the dev@apache.org mailing list, i.e. by sending
an email to dev-subscribe@apache.org.
To unsubscribe, send an email to dev-unsubscribe@apache.org.
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Peter <pe...@gmail.com>.
Why am I getting these emails?
Please explain what this email is saying basically.
How did you get my info?
On Fri, 8 May 2026, 13:47 Steffen, <in...@apachelounge.com> wrote:
> Please vote:
>
>
> [ ] No - keep the current process
>
> [ ] Yes - push Low severity issues as obfuscated public commits
>
> [ X] Yes - push Low+Moderate severity issues as obfuscated public commits
>
> Op 8 mei 2026 om 14:37 heeft Rainer Jung <ra...@kippdata.de> het
> volgende geschreven:
>
> Am 08.05.26 um 14:27 schrieb Steffen:
> > Sorry can you explain obfuscated. Translate to Dutch makes no sense. See
> attachment.
>
> It might be "verhullen".
>
> Meaning (as Joe already wrote) we do not mention the security impact in
> the original commit message, only the local change without too much detail.
>
>
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Steffen <in...@apachelounge.com>.
Please vote:
[ ] No - keep the current process
[ ] Yes - push Low severity issues as obfuscated public commits
[ X] Yes - push Low+Moderate severity issues as obfuscated public commits
> Op 8 mei 2026 om 14:37 heeft Rainer Jung <ra...@kippdata.de> het volgende geschreven:
> Am 08.05.26 um 14:27 schrieb Steffen:
> > Sorry can you explain obfuscated. Translate to Dutch makes no sense. See attachment.
>
> It might be "verhullen".
>
> Meaning (as Joe already wrote) we do not mention the security impact in the original commit message, only the local change without too much detail.
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Rainer Jung <ra...@kippdata.de>.
Am 08.05.26 um 14:27 schrieb Steffen:
> Sorry can you explain obfuscated. Translate to Dutch makes no sense.
See attachment.
It might be "verhullen".
Meaning (as Joe already wrote) we do not mention the security impact in
the original commit message, only the local change without too much detail.
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Steffen <in...@apachelounge.com>.
Sorry can you explain obfuscated. Translate to Dutch makes no sense. See attachment.
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Frank Gingras <th...@apache.org>.
On Tue, May 12, 2026 at 4:24 PM Christophe JAILLET <
christophe.jaillet@wanadoo.fr> wrote:
>
> Le 08/05/2026 à 13:31, Joe Orton a écrit :
> > Hi all, another vote -
> >
> > We currently track all security issues in private, pushing these to the
> > public repos only during the preparation for a release. This adds
> > significant overhead for committers handling the current surge of
> > reports - a surge which mostly comprises Low severity issues. It also
> > delays us getting CI runs, which potentially delays the release, exactly
> > as happened with the recent mod_auth_digest fix in 2.4.67.
> >
> > I'm proposing that we change the process: once we confirm a Low (and
> > maybe Moderate) severity issue, the fix can be pushed to the public
> > repos like any other change, with a deliberately obfuscated commit
> > message to conceal the security impact. The ASF Security team is fine
> > with this approach per [1], though cautions us to not keep the obscured
> > commits public for too long before a release.
> >
> > Please vote:
> >
> > [ ] No - keep the current process
> > [X] Yes - push Low severity issues as obfuscated public commits
> > [ ] Yes - push Low+Moderate severity issues as obfuscated public commits
> >
> > If you're fine with either Low or Low+Moderate vote "Yes" on both and
> > we'll see where the majority lies?
> >
> > Regards, Joe
> >
> > [1]
> https://cwiki.apache.org/confluence/display/SECURITY/Working+In+Private
> >
>
I was initially wary of the third option, but I reconsidered the risks.
[x ] Yes - push Low severity issues as obfuscated public commits
[x ] Yes - push Low+Moderate severity issues as obfuscated public commits
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Christophe JAILLET <ch...@wanadoo.fr>.
Le 08/05/2026 à 13:31, Joe Orton a écrit :
> Hi all, another vote -
>
> We currently track all security issues in private, pushing these to the
> public repos only during the preparation for a release. This adds
> significant overhead for committers handling the current surge of
> reports - a surge which mostly comprises Low severity issues. It also
> delays us getting CI runs, which potentially delays the release, exactly
> as happened with the recent mod_auth_digest fix in 2.4.67.
>
> I'm proposing that we change the process: once we confirm a Low (and
> maybe Moderate) severity issue, the fix can be pushed to the public
> repos like any other change, with a deliberately obfuscated commit
> message to conceal the security impact. The ASF Security team is fine
> with this approach per [1], though cautions us to not keep the obscured
> commits public for too long before a release.
>
> Please vote:
>
> [ ] No - keep the current process
> [X] Yes - push Low severity issues as obfuscated public commits
> [ ] Yes - push Low+Moderate severity issues as obfuscated public commits
>
> If you're fine with either Low or Low+Moderate vote "Yes" on both and
> we'll see where the majority lies?
>
> Regards, Joe
>
> [1] https://cwiki.apache.org/confluence/display/SECURITY/Working+In+Private
>
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Rainer Jung <ra...@kippdata.de>.
Am 08.05.26 um 13:31 schrieb Joe Orton:
> Hi all, another vote -
>
> We currently track all security issues in private, pushing these to the
> public repos only during the preparation for a release. This adds
> significant overhead for committers handling the current surge of
> reports - a surge which mostly comprises Low severity issues. It also
> delays us getting CI runs, which potentially delays the release, exactly
> as happened with the recent mod_auth_digest fix in 2.4.67.
>
> I'm proposing that we change the process: once we confirm a Low (and
> maybe Moderate) severity issue, the fix can be pushed to the public
> repos like any other change, with a deliberately obfuscated commit
> message to conceal the security impact. The ASF Security team is fine
> with this approach per [1], though cautions us to not keep the obscured
> commits public for too long before a release.
>
> Please vote:
[ ] No - keep the current process
[X] Yes - push Low severity issues as obfuscated public commits
[X] Yes - push Low+Moderate severity issues as obfuscated public commits
> If you're fine with either Low or Low+Moderate vote "Yes" on both and
> we'll see where the majority lies?
>
> Regards, Joe
>
> [1] https://cwiki.apache.org/confluence/display/SECURITY/Working+In+Private
Thanks and regards,
Rainer
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Steffen <in...@apachelounge.com>.
Sorry can you explain obfuscated. Translate to Dutch makes no sense. See attachment.
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Eric Covener <co...@gmail.com>.
On Fri, May 8, 2026 at 7:31 AM Joe Orton <jo...@redhat.com> wrote:
>
> Hi all, another vote -
>
> We currently track all security issues in private, pushing these to the
> public repos only during the preparation for a release. This adds
> significant overhead for committers handling the current surge of
> reports - a surge which mostly comprises Low severity issues. It also
> delays us getting CI runs, which potentially delays the release, exactly
> as happened with the recent mod_auth_digest fix in 2.4.67.
>
> I'm proposing that we change the process: once we confirm a Low (and
> maybe Moderate) severity issue, the fix can be pushed to the public
> repos like any other change, with a deliberately obfuscated commit
> message to conceal the security impact. The ASF Security team is fine
> with this approach per [1], though cautions us to not keep the obscured
> commits public for too long before a release.
>
> Please vote:
>
> [ ] No - keep the current process
> [x] Yes - push Low severity issues as obfuscated public commits
> [x] Yes - push Low+Moderate severity issues as obfuscated public commits
I am assuming we'd still do most of the same private tracking for
these (and add a way to save the 2.4.x revision).
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Joe Orton <jo...@apache.org>.
On Fri, May 08, 2026 at 12:31:31PM +0100, Joe Orton wrote:
> Please vote:
>
> [ ] No - keep the current process
> [X] Yes - push Low severity issues as obfuscated public commits
> [X] Yes - push Low+Moderate severity issues as obfuscated public commits
My vote, though I'm more on the fence about Moderates. Also worth saying
this doesn't need to be set in stone.
Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Ruediger Pluem <rp...@apache.org>.
On 5/8/26 1:31 PM, Joe Orton wrote:
> Hi all, another vote -
>
> We currently track all security issues in private, pushing these to the
> public repos only during the preparation for a release. This adds
> significant overhead for committers handling the current surge of
> reports - a surge which mostly comprises Low severity issues. It also
> delays us getting CI runs, which potentially delays the release, exactly
> as happened with the recent mod_auth_digest fix in 2.4.67.
>
> I'm proposing that we change the process: once we confirm a Low (and
> maybe Moderate) severity issue, the fix can be pushed to the public
> repos like any other change, with a deliberately obfuscated commit
> message to conceal the security impact. The ASF Security team is fine
> with this approach per [1], though cautions us to not keep the obscured
> commits public for too long before a release.
>
> Please vote:
>
> [ ] No - keep the current process
> [X] Yes - push Low severity issues as obfuscated public commits
> [ ] Yes - push Low+Moderate severity issues as obfuscated public commits
>
Regards
Rüdiger
[RESULT] was Re: [VOTE] commit Low/Moderate severity security issues to public repos
Posted by Joe Orton <jo...@apache.org>.
OK, this has run a week.
I'm going to infer that people voting for "Low+Moderate" are also OK
with just "Low", and the PMC votes were as follows:
No: (0 votes)
Low: covener, steffenal, rpluem, jorton, jclere, rjung, jailletc36, thumbs (8 votes)
Low+Moderate: covener, steffenal, jorton, jclere, rjung, thumbs (6 votes)
The majority is for handling only Low severity issues via obfuscated
commits, and we continue with the current process for everything else.
Thanks all.
Regards, Joe