You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@openoffice.apache.org by Shane Curcuru <as...@shanecurcuru.org> on 2011/10/10 18:54:35 UTC
Fixing security lists (was: Vulnerability fixed in LibreOffice)
On 10/10/2011 12:33 PM, Malte Timmermann wrote:
...snip...
> - Which leaves us with 1 common list where we don't have such
> restrictive rules, and can continue with our cooperation: The
> old/original OOo security list securityteam@openoffice.org.
...snip...
To ask a practical question: is there anyone reading this email who is
able to, and is willing to, manage the subscribers and archives for that
list currently?
Of not, the PPMC certainly needs to find such person ASAP so we know
who's on the list, and so we can archive (privately) any ongoing list
traffic someplace that has ASF Member and ooo-security@ oversight of the
archive (at minimum, obviously any approved subscribers - from whatever
organizatoins - should have some kind of archive access to the list).
- Shane
Re: Fixing security lists
Posted by Shane Curcuru <as...@shanecurcuru.org>.
Yes, looks good, thanks.
Ooooh... I have to savor this moment. Legitimately reposting a note
from a security-based list on a public list. I'm such a rebel today.
> Subject Welcome to the securityteam@openoffice.org mailing list!
> Date Tue, 11 Oct 2011 13:32:57 GMT
>
> This is a confirmation email that you have subscribed to the
> securityteam@openoffice.org mailing list.
- Shane
On 10/11/2011 9:37 AM, Martin Hollmichel wrote:
> Shane,
> done, and sent out a welcome mail, please confirm if this got through to
> your list,
>
> Martin
>
> Am Dienstag, 11. Oktober 2011 15:29:07 schrieb Shane Curcuru:
>> Thanks Martin. Could you please subscribe our privately archived
>> mailing list <oo...@incubator.apache.org> to the securityteam@
>> mailing list?
>>
>> Note that it's an ezmlm mailing list, so if a confirmation email is
>> needed we'll need someone on our ooo-security list to confirm it.
>>
>> The purpose of doing this is to ensure that the Apache OOo PPMC's
>> security team - who monitors ooo-security@ - is aware of any end user
>> reports that come into the pre-existing securityteam@ list.
>>
>> Privacy and reporting guidelines for the ooo-security@ list follow
>> best Apache security@ practices and are documented here:
>>
>> http://incubator.apache.org/openofficeorg/security.html
>>
>> Thanks,
>> - Shane, Mentor on Apache OOo
>>
>> bcc: ooo-security@ for awareness
>>
>> On 10/11/2011 6:08 AM, Martin Hollmichel wrote:
>>> Hi Shane,
>>>
>>> yes, it looks like that I'm able to edit the list of subscribers,
>>>
>>> Martin
>>>
>>> Am 10.10.2011 18:54, schrieb Shane Curcuru:
>>>> On 10/10/2011 12:33 PM, Malte Timmermann wrote:
>>>> ...snip...
>>>>> - Which leaves us with 1 common list where we don't have such
>>>>> restrictive rules, and can continue with our cooperation: The
>>>>> old/original OOo security list securityteam@openoffice.org.
>>>> ...snip...
>>>>
>>>> To ask a practical question: is there anyone reading this email who is
>>>> able to, and is willing to, manage the subscribers and archives for
>>>> that list currently?
>>>>
>>>> Of not, the PPMC certainly needs to find such person ASAP so we know
>>>> who's on the list, and so we can archive (privately) any ongoing list
>>>> traffic someplace that has ASF Member and ooo-security@ oversight of
>>>> the archive (at minimum, obviously any approved subscribers - from
>>>> whatever organizatoins - should have some kind of archive access to
>>>> the list).
>>>>
>>>> - Shane
>>>
>
>
Re: Fixing security lists
Posted by Rob Weir <ro...@apache.org>.
On Tue, Oct 11, 2011 at 10:14 AM, Dennis E. Hamilton <or...@apache.org> wrote:
> Martin,
>
> The subscription confirmation reached ooo-security @i.a.o.
>
If I understand this correctly, any message sent to the securityteam
list (the legacy OOo security list) automatically gets delivered to
the ooo-security list (the AOOo security list). So we've eliminated a
possible source of confusion and miscommunication.
This sounds like a good solution. Thanks, Shane and Martin!
-Rob
> -----Original Message-----
> From: Martin Hollmichel [mailto:martin.hollmichel@googlemail.com]
> Sent: Tuesday, October 11, 2011 06:37
> To: Shane Curcuru
> Cc: ooo-dev@incubator.apache.org
> Subject: Re: Fixing security lists
>
> Shane,
>
> done, and sent out a welcome mail, please confirm if this got through
> to your list,
>
> Martin
>
> Am Dienstag, 11. Oktober 2011 15:29:07 schrieb Shane Curcuru:
>> Thanks Martin. Could you please subscribe our privately archived
>> mailing list <oo...@incubator.apache.org> to the securityteam@
>> mailing list?
>>
>> Note that it's an ezmlm mailing list, so if a confirmation email is
>> needed we'll need someone on our ooo-security list to confirm it.
>>
>> The purpose of doing this is to ensure that the Apache OOo PPMC's
>> security team - who monitors ooo-security@ - is aware of any end user
>> reports that come into the pre-existing securityteam@ list.
>>
>> Privacy and reporting guidelines for the ooo-security@ list follow
>> best Apache security@ practices and are documented here:
>>
>> http://incubator.apache.org/openofficeorg/security.html
>>
>> Thanks,
>> - Shane, Mentor on Apache OOo
>>
>> bcc: ooo-security@ for awareness
>>
>> On 10/11/2011 6:08 AM, Martin Hollmichel wrote:
>>> Hi Shane,
>>>
>>> yes, it looks like that I'm able to edit the list of subscribers,
>>>
>>> Martin
>>>
>>> Am 10.10.2011 18:54, schrieb Shane Curcuru:
>>>> On 10/10/2011 12:33 PM, Malte Timmermann wrote:
>>>> ...snip...
>>>>> - Which leaves us with 1 common list where we don't have such
>>>>> restrictive rules, and can continue with our cooperation: The
>>>>> old/original OOo security list securityteam@openoffice.org.
>>>> ...snip...
>>>>
>>>> To ask a practical question: is there anyone reading this email who is
>>>> able to, and is willing to, manage the subscribers and archives for
>>>> that list currently?
>>>>
>>>> Of not, the PPMC certainly needs to find such person ASAP so we know
>>>> who's on the list, and so we can archive (privately) any ongoing list
>>>> traffic someplace that has ASF Member and ooo-security@ oversight of
>>>> the archive (at minimum, obviously any approved subscribers - from
>>>> whatever organizatoins - should have some kind of archive access to
>>>> the list).
>>>>
>>>> - Shane
>>>
>
>
RE: Fixing security lists
Posted by "Dennis E. Hamilton" <or...@apache.org>.
Martin,
The subscription confirmation reached ooo-security @i.a.o.
-----Original Message-----
From: Martin Hollmichel [mailto:martin.hollmichel@googlemail.com]
Sent: Tuesday, October 11, 2011 06:37
To: Shane Curcuru
Cc: ooo-dev@incubator.apache.org
Subject: Re: Fixing security lists
Shane,
done, and sent out a welcome mail, please confirm if this got through
to your list,
Martin
Am Dienstag, 11. Oktober 2011 15:29:07 schrieb Shane Curcuru:
> Thanks Martin. Could you please subscribe our privately archived
> mailing list <oo...@incubator.apache.org> to the securityteam@
> mailing list?
>
> Note that it's an ezmlm mailing list, so if a confirmation email is
> needed we'll need someone on our ooo-security list to confirm it.
>
> The purpose of doing this is to ensure that the Apache OOo PPMC's
> security team - who monitors ooo-security@ - is aware of any end user
> reports that come into the pre-existing securityteam@ list.
>
> Privacy and reporting guidelines for the ooo-security@ list follow
> best Apache security@ practices and are documented here:
>
> http://incubator.apache.org/openofficeorg/security.html
>
> Thanks,
> - Shane, Mentor on Apache OOo
>
> bcc: ooo-security@ for awareness
>
> On 10/11/2011 6:08 AM, Martin Hollmichel wrote:
>> Hi Shane,
>>
>> yes, it looks like that I'm able to edit the list of subscribers,
>>
>> Martin
>>
>> Am 10.10.2011 18:54, schrieb Shane Curcuru:
>>> On 10/10/2011 12:33 PM, Malte Timmermann wrote:
>>> ...snip...
>>>> - Which leaves us with 1 common list where we don't have such
>>>> restrictive rules, and can continue with our cooperation: The
>>>> old/original OOo security list securityteam@openoffice.org.
>>> ...snip...
>>>
>>> To ask a practical question: is there anyone reading this email who is
>>> able to, and is willing to, manage the subscribers and archives for
>>> that list currently?
>>>
>>> Of not, the PPMC certainly needs to find such person ASAP so we know
>>> who's on the list, and so we can archive (privately) any ongoing list
>>> traffic someplace that has ASF Member and ooo-security@ oversight of
>>> the archive (at minimum, obviously any approved subscribers - from
>>> whatever organizatoins - should have some kind of archive access to
>>> the list).
>>>
>>> - Shane
>>
Re: Fixing security lists
Posted by TJ Frazier <tj...@cfl.rr.com>.
On 10/13/2011 08:17, Rob Weir wrote:
> On Thu, Oct 13, 2011 at 8:00 AM, TJ Frazier<tj...@cfl.rr.com> wrote:
>> On 10/13/2011 07:39, Rob Weir wrote:
>>>
>>> On Tue, Oct 11, 2011 at 9:37 AM, Martin Hollmichel
>>> <ma...@googlemail.com> wrote:
>>>>
>>>> Shane,
>>>> done, and sent out a welcome mail, please confirm if this got through to
>>>> your list,
>>>>
>>>> Martin
>>>>
>>>
>>> Martin, I did see two notes come through to the ooo-security list from
>>> securityteam. However, my responses were not led through. They
>>> appear to have been caught in moderation. But this has been 24 hours
>>> now. I'd hate to think that posts to that list, including potential
>>> reports of real security issues, were being delayed by insufficient
>>> moderator attention.
>>>
>>> Can you add me as a moderator of the securityteam list? Perhaps
>>> Dennis as well, if he is willing? We need to ensure that
>>> communication is working in both directions.
>>>
>>> -Rob
>>>
>> Rob, Martin,
>>
>> As a moderator using SYMPA (the Kenai mail-handler) I caution that
>> moderating requires some active work; for some reason, not all messages are
>> delivered to the moderators, but are held in the queue. I visit the ML page
>> daily, and moderate from there.
>>
>
> So do you see my two emails in the queue?
>
> -Rob
>
Briefly, no.
Moderation rights (and queues) are per ML. I am owner/moderator of two
moribund lists: dev@documentation.openoffice.org and
authors@documentation.openoffice.org so if you post there I will see it,
sooner or later. Otherwise, no.
--
/tj/
Re: Fixing security lists
Posted by Rob Weir <ro...@apache.org>.
On Thu, Oct 13, 2011 at 8:00 AM, TJ Frazier <tj...@cfl.rr.com> wrote:
> On 10/13/2011 07:39, Rob Weir wrote:
>>
>> On Tue, Oct 11, 2011 at 9:37 AM, Martin Hollmichel
>> <ma...@googlemail.com> wrote:
>>>
>>> Shane,
>>> done, and sent out a welcome mail, please confirm if this got through to
>>> your list,
>>>
>>> Martin
>>>
>>
>> Martin, I did see two notes come through to the ooo-security list from
>> securityteam. However, my responses were not led through. They
>> appear to have been caught in moderation. But this has been 24 hours
>> now. I'd hate to think that posts to that list, including potential
>> reports of real security issues, were being delayed by insufficient
>> moderator attention.
>>
>> Can you add me as a moderator of the securityteam list? Perhaps
>> Dennis as well, if he is willing? We need to ensure that
>> communication is working in both directions.
>>
>> -Rob
>>
> Rob, Martin,
>
> As a moderator using SYMPA (the Kenai mail-handler) I caution that
> moderating requires some active work; for some reason, not all messages are
> delivered to the moderators, but are held in the queue. I visit the ML page
> daily, and moderate from there.
>
So do you see my two emails in the queue?
-Rob
> --
> /tj/
>
>
Re: Fixing security lists
Posted by TJ Frazier <tj...@cfl.rr.com>.
On 10/13/2011 07:39, Rob Weir wrote:
> On Tue, Oct 11, 2011 at 9:37 AM, Martin Hollmichel
> <ma...@googlemail.com> wrote:
>> Shane,
>> done, and sent out a welcome mail, please confirm if this got through to
>> your list,
>>
>> Martin
>>
>
> Martin, I did see two notes come through to the ooo-security list from
> securityteam. However, my responses were not led through. They
> appear to have been caught in moderation. But this has been 24 hours
> now. I'd hate to think that posts to that list, including potential
> reports of real security issues, were being delayed by insufficient
> moderator attention.
>
> Can you add me as a moderator of the securityteam list? Perhaps
> Dennis as well, if he is willing? We need to ensure that
> communication is working in both directions.
>
> -Rob
>
Rob, Martin,
As a moderator using SYMPA (the Kenai mail-handler) I caution that
moderating requires some active work; for some reason, not all messages
are delivered to the moderators, but are held in the queue. I visit the
ML page daily, and moderate from there.
--
/tj/
Re: Fixing security lists
Posted by Rob Weir <ro...@apache.org>.
2011/10/18 Jürgen Schmidt <jo...@googlemail.com>:
> On Thu, Oct 13, 2011 at 3:46 PM, Martin Hollmichel <
> martin.hollmichel@googlemail.com> wrote:
>
>> Am 13.10.2011 14:28, schrieb Rob Weir:
>>
>> My OOo ID is: robweir. That is associated with email address:
>>> robweir@apache.org
>>>
>> ok, should work now,
>>
>> Martin
>>
>>
> is it possible to add me as well? I have already signaled to take care of
> security issues in the future and i think having more people on the list who
> actively working on the project is a good idea.
>
> @Rob, whom i should contact to become added on our ooo-secuirty list?
>
I'd recommend starting a top level thread and seek lazy consensus.
Actually getting added would require a request to Apache Infra. I can
post a proposal thread.
Thanks for volunteering. We could use people closer to the code.
-Rob
> Juergen
>
Re: Fixing security lists
Posted by Jürgen Schmidt <jo...@googlemail.com>.
On Thu, Oct 13, 2011 at 3:46 PM, Martin Hollmichel <
martin.hollmichel@googlemail.com> wrote:
> Am 13.10.2011 14:28, schrieb Rob Weir:
>
> My OOo ID is: robweir. That is associated with email address:
>> robweir@apache.org
>>
> ok, should work now,
>
> Martin
>
>
is it possible to add me as well? I have already signaled to take care of
security issues in the future and i think having more people on the list who
actively working on the project is a good idea.
@Rob, whom i should contact to become added on our ooo-secuirty list?
Juergen
Re: Fixing security lists
Posted by Martin Hollmichel <ma...@googlemail.com>.
Am 13.10.2011 14:28, schrieb Rob Weir:
> My OOo ID is: robweir. That is associated with email address:
> robweir@apache.org
ok, should work now,
Martin
Re: Fixing security lists
Posted by Rob Weir <ro...@apache.org>.
On Thu, Oct 13, 2011 at 8:03 AM, Martin Hollmichel
<ma...@googlemail.com> wrote:
> Oh, I see now, the email notification for moderator does not seem to work
> properly, and you used for your posting a different email adress as you're
> subscribed with.
>
> For adding you as moderator I need to know what your email address you're
> registered at the openoffice.org site ?
>
My OOo ID is: robweir. That is associated with email address:
robweir@apache.org
Thanks!
-Rob
> Martin
>
>
>
> Am 13.10.2011 13:39, schrieb Rob Weir:
>>
>> On Tue, Oct 11, 2011 at 9:37 AM, Martin Hollmichel
>> <ma...@googlemail.com> wrote:
>>>
>>> Shane,
>>> done, and sent out a welcome mail, please confirm if this got through to
>>> your list,
>>>
>>> Martin
>>>
>> Martin, I did see two notes come through to the ooo-security list from
>> securityteam. However, my responses were not led through. They
>> appear to have been caught in moderation. But this has been 24 hours
>> now. I'd hate to think that posts to that list, including potential
>> reports of real security issues, were being delayed by insufficient
>> moderator attention.
>>
>> Can you add me as a moderator of the securityteam list? Perhaps
>> Dennis as well, if he is willing? We need to ensure that
>> communication is working in both directions.
>>
>> -Rob
>>
>>
>>> Am Dienstag, 11. Oktober 2011 15:29:07 schrieb Shane Curcuru:
>>>>
>>>> Thanks Martin. Could you please subscribe our privately archived mailing
>>>> list<oo...@incubator.apache.org> to the securityteam@ mailing
>>>> list?
>>>>
>>>> Note that it's an ezmlm mailing list, so if a confirmation email is
>>>> needed
>>>> we'll need someone on our ooo-security list to confirm it.
>>>>
>>>> The purpose of doing this is to ensure that the Apache OOo PPMC's
>>>> security
>>>> team - who monitors ooo-security@ - is aware of any end user reports
>>>> that
>>>> come into the pre-existing securityteam@ list.
>>>>
>>>> Privacy and reporting guidelines for the ooo-security@ list follow best
>>>> Apache security@ practices and are documented here:
>>>>
>>>> http://incubator.apache.org/openofficeorg/security.html
>>>>
>>>> Thanks,
>>>> - Shane, Mentor on Apache OOo
>>>>
>>>> bcc: ooo-security@ for awareness
>>>>
>>>> On 10/11/2011 6:08 AM, Martin Hollmichel wrote:
>>>>>
>>>>> Hi Shane,
>>>>>
>>>>> yes, it looks like that I'm able to edit the list of subscribers,
>>>>>
>>>>> Martin
>>>>>
>>>>> Am 10.10.2011 18:54, schrieb Shane Curcuru:
>>>>>>
>>>>>> On 10/10/2011 12:33 PM, Malte Timmermann wrote:
>>>>>> ...snip...
>>>>>>>
>>>>>>> - Which leaves us with 1 common list where we don't have such
>>>>>>> restrictive rules, and can continue with our cooperation: The
>>>>>>> old/original OOo security list securityteam@openoffice.org.
>>>>>>
>>>>>> ...snip...
>>>>>>
>>>>>> To ask a practical question: is there anyone reading this email who is
>>>>>> able to, and is willing to, manage the subscribers and archives for
>>>>>> that list currently?
>>>>>>
>>>>>> Of not, the PPMC certainly needs to find such person ASAP so we know
>>>>>> who's on the list, and so we can archive (privately) any ongoing list
>>>>>> traffic someplace that has ASF Member and ooo-security@ oversight of
>>>>>> the archive (at minimum, obviously any approved subscribers - from
>>>>>> whatever organizatoins - should have some kind of archive access to
>>>>>> the list).
>>>>>>
>>>>>> - Shane
>>>
>>>
>
>
Re: Fixing security lists
Posted by Martin Hollmichel <ma...@googlemail.com>.
Oh, I see now, the email notification for moderator does not seem to
work properly, and you used for your posting a different email adress as
you're subscribed with.
For adding you as moderator I need to know what your email address
you're registered at the openoffice.org site ?
Martin
Am 13.10.2011 13:39, schrieb Rob Weir:
> On Tue, Oct 11, 2011 at 9:37 AM, Martin Hollmichel
> <ma...@googlemail.com> wrote:
>> Shane,
>> done, and sent out a welcome mail, please confirm if this got through to
>> your list,
>>
>> Martin
>>
> Martin, I did see two notes come through to the ooo-security list from
> securityteam. However, my responses were not led through. They
> appear to have been caught in moderation. But this has been 24 hours
> now. I'd hate to think that posts to that list, including potential
> reports of real security issues, were being delayed by insufficient
> moderator attention.
>
> Can you add me as a moderator of the securityteam list? Perhaps
> Dennis as well, if he is willing? We need to ensure that
> communication is working in both directions.
>
> -Rob
>
>
>> Am Dienstag, 11. Oktober 2011 15:29:07 schrieb Shane Curcuru:
>>> Thanks Martin. Could you please subscribe our privately archived mailing
>>> list<oo...@incubator.apache.org> to the securityteam@ mailing list?
>>>
>>> Note that it's an ezmlm mailing list, so if a confirmation email is needed
>>> we'll need someone on our ooo-security list to confirm it.
>>>
>>> The purpose of doing this is to ensure that the Apache OOo PPMC's security
>>> team - who monitors ooo-security@ - is aware of any end user reports that
>>> come into the pre-existing securityteam@ list.
>>>
>>> Privacy and reporting guidelines for the ooo-security@ list follow best
>>> Apache security@ practices and are documented here:
>>>
>>> http://incubator.apache.org/openofficeorg/security.html
>>>
>>> Thanks,
>>> - Shane, Mentor on Apache OOo
>>>
>>> bcc: ooo-security@ for awareness
>>>
>>> On 10/11/2011 6:08 AM, Martin Hollmichel wrote:
>>>> Hi Shane,
>>>>
>>>> yes, it looks like that I'm able to edit the list of subscribers,
>>>>
>>>> Martin
>>>>
>>>> Am 10.10.2011 18:54, schrieb Shane Curcuru:
>>>>> On 10/10/2011 12:33 PM, Malte Timmermann wrote:
>>>>> ...snip...
>>>>>> - Which leaves us with 1 common list where we don't have such
>>>>>> restrictive rules, and can continue with our cooperation: The
>>>>>> old/original OOo security list securityteam@openoffice.org.
>>>>> ...snip...
>>>>>
>>>>> To ask a practical question: is there anyone reading this email who is
>>>>> able to, and is willing to, manage the subscribers and archives for
>>>>> that list currently?
>>>>>
>>>>> Of not, the PPMC certainly needs to find such person ASAP so we know
>>>>> who's on the list, and so we can archive (privately) any ongoing list
>>>>> traffic someplace that has ASF Member and ooo-security@ oversight of
>>>>> the archive (at minimum, obviously any approved subscribers - from
>>>>> whatever organizatoins - should have some kind of archive access to
>>>>> the list).
>>>>>
>>>>> - Shane
>>
>>
Re: Fixing security lists
Posted by Rob Weir <ro...@apache.org>.
On Tue, Oct 11, 2011 at 9:37 AM, Martin Hollmichel
<ma...@googlemail.com> wrote:
> Shane,
> done, and sent out a welcome mail, please confirm if this got through to
> your list,
>
> Martin
>
Martin, I did see two notes come through to the ooo-security list from
securityteam. However, my responses were not led through. They
appear to have been caught in moderation. But this has been 24 hours
now. I'd hate to think that posts to that list, including potential
reports of real security issues, were being delayed by insufficient
moderator attention.
Can you add me as a moderator of the securityteam list? Perhaps
Dennis as well, if he is willing? We need to ensure that
communication is working in both directions.
-Rob
> Am Dienstag, 11. Oktober 2011 15:29:07 schrieb Shane Curcuru:
>>
>> Thanks Martin. Could you please subscribe our privately archived mailing
>> list <oo...@incubator.apache.org> to the securityteam@ mailing list?
>>
>> Note that it's an ezmlm mailing list, so if a confirmation email is needed
>> we'll need someone on our ooo-security list to confirm it.
>>
>> The purpose of doing this is to ensure that the Apache OOo PPMC's security
>> team - who monitors ooo-security@ - is aware of any end user reports that
>> come into the pre-existing securityteam@ list.
>>
>> Privacy and reporting guidelines for the ooo-security@ list follow best
>> Apache security@ practices and are documented here:
>>
>> http://incubator.apache.org/openofficeorg/security.html
>>
>> Thanks,
>> - Shane, Mentor on Apache OOo
>>
>> bcc: ooo-security@ for awareness
>>
>> On 10/11/2011 6:08 AM, Martin Hollmichel wrote:
>>>
>>> Hi Shane,
>>>
>>> yes, it looks like that I'm able to edit the list of subscribers,
>>>
>>> Martin
>>>
>>> Am 10.10.2011 18:54, schrieb Shane Curcuru:
>>>>
>>>> On 10/10/2011 12:33 PM, Malte Timmermann wrote:
>>>> ...snip...
>>>>>
>>>>> - Which leaves us with 1 common list where we don't have such
>>>>> restrictive rules, and can continue with our cooperation: The
>>>>> old/original OOo security list securityteam@openoffice.org.
>>>>
>>>> ...snip...
>>>>
>>>> To ask a practical question: is there anyone reading this email who is
>>>> able to, and is willing to, manage the subscribers and archives for
>>>> that list currently?
>>>>
>>>> Of not, the PPMC certainly needs to find such person ASAP so we know
>>>> who's on the list, and so we can archive (privately) any ongoing list
>>>> traffic someplace that has ASF Member and ooo-security@ oversight of
>>>> the archive (at minimum, obviously any approved subscribers - from
>>>> whatever organizatoins - should have some kind of archive access to
>>>> the list).
>>>>
>>>> - Shane
>>>
>
>
>
Re: Fixing security lists
Posted by Martin Hollmichel <ma...@googlemail.com>.
Shane,
done, and sent out a welcome mail, please confirm if this got through
to your list,
Martin
Am Dienstag, 11. Oktober 2011 15:29:07 schrieb Shane Curcuru:
> Thanks Martin. Could you please subscribe our privately archived
> mailing list <oo...@incubator.apache.org> to the securityteam@
> mailing list?
>
> Note that it's an ezmlm mailing list, so if a confirmation email is
> needed we'll need someone on our ooo-security list to confirm it.
>
> The purpose of doing this is to ensure that the Apache OOo PPMC's
> security team - who monitors ooo-security@ - is aware of any end user
> reports that come into the pre-existing securityteam@ list.
>
> Privacy and reporting guidelines for the ooo-security@ list follow
> best Apache security@ practices and are documented here:
>
> http://incubator.apache.org/openofficeorg/security.html
>
> Thanks,
> - Shane, Mentor on Apache OOo
>
> bcc: ooo-security@ for awareness
>
> On 10/11/2011 6:08 AM, Martin Hollmichel wrote:
>> Hi Shane,
>>
>> yes, it looks like that I'm able to edit the list of subscribers,
>>
>> Martin
>>
>> Am 10.10.2011 18:54, schrieb Shane Curcuru:
>>> On 10/10/2011 12:33 PM, Malte Timmermann wrote:
>>> ...snip...
>>>> - Which leaves us with 1 common list where we don't have such
>>>> restrictive rules, and can continue with our cooperation: The
>>>> old/original OOo security list securityteam@openoffice.org.
>>> ...snip...
>>>
>>> To ask a practical question: is there anyone reading this email who is
>>> able to, and is willing to, manage the subscribers and archives for
>>> that list currently?
>>>
>>> Of not, the PPMC certainly needs to find such person ASAP so we know
>>> who's on the list, and so we can archive (privately) any ongoing list
>>> traffic someplace that has ASF Member and ooo-security@ oversight of
>>> the archive (at minimum, obviously any approved subscribers - from
>>> whatever organizatoins - should have some kind of archive access to
>>> the list).
>>>
>>> - Shane
>>
Re: Fixing security lists
Posted by Shane Curcuru <as...@shanecurcuru.org>.
Thanks Martin. Could you please subscribe our privately archived
mailing list <oo...@incubator.apache.org> to the securityteam@
mailing list?
Note that it's an ezmlm mailing list, so if a confirmation email is
needed we'll need someone on our ooo-security list to confirm it.
The purpose of doing this is to ensure that the Apache OOo PPMC's
security team - who monitors ooo-security@ - is aware of any end user
reports that come into the pre-existing securityteam@ list.
Privacy and reporting guidelines for the ooo-security@ list follow best
Apache security@ practices and are documented here:
http://incubator.apache.org/openofficeorg/security.html
Thanks,
- Shane, Mentor on Apache OOo
bcc: ooo-security@ for awareness
On 10/11/2011 6:08 AM, Martin Hollmichel wrote:
> Hi Shane,
>
> yes, it looks like that I'm able to edit the list of subscribers,
>
> Martin
>
> Am 10.10.2011 18:54, schrieb Shane Curcuru:
>> On 10/10/2011 12:33 PM, Malte Timmermann wrote:
>> ...snip...
>>> - Which leaves us with 1 common list where we don't have such
>>> restrictive rules, and can continue with our cooperation: The
>>> old/original OOo security list securityteam@openoffice.org.
>> ...snip...
>>
>> To ask a practical question: is there anyone reading this email who is
>> able to, and is willing to, manage the subscribers and archives for
>> that list currently?
>>
>> Of not, the PPMC certainly needs to find such person ASAP so we know
>> who's on the list, and so we can archive (privately) any ongoing list
>> traffic someplace that has ASF Member and ooo-security@ oversight of
>> the archive (at minimum, obviously any approved subscribers - from
>> whatever organizatoins - should have some kind of archive access to
>> the list).
>>
>> - Shane
>
Re: Fixing security lists
Posted by Martin Hollmichel <ma...@googlemail.com>.
Hi Shane,
yes, it looks like that I'm able to edit the list of subscribers,
Martin
Am 10.10.2011 18:54, schrieb Shane Curcuru:
> On 10/10/2011 12:33 PM, Malte Timmermann wrote:
> ...snip...
>> - Which leaves us with 1 common list where we don't have such
>> restrictive rules, and can continue with our cooperation: The
>> old/original OOo security list securityteam@openoffice.org.
> ...snip...
>
> To ask a practical question: is there anyone reading this email who is
> able to, and is willing to, manage the subscribers and archives for
> that list currently?
>
> Of not, the PPMC certainly needs to find such person ASAP so we know
> who's on the list, and so we can archive (privately) any ongoing list
> traffic someplace that has ASF Member and ooo-security@ oversight of
> the archive (at minimum, obviously any approved subscribers - from
> whatever organizatoins - should have some kind of archive access to
> the list).
>
> - Shane
Re: Fixing security lists
Posted by Malte Timmermann <ma...@gmx.com>.
I can moderate securityteam@openoffice.org, and I have a list of current
subscribers, but I can't view/modify members.
The list is not part of the security project, but is a top level list in
the WWW project.
I will ask stx if a can give me the needed access rights.
For now - maybe I can approve members if they try to subscribe. Not sure.
Malte.
On 10.10.2011 18:54, Shane Curcuru wrote:
> On 10/10/2011 12:33 PM, Malte Timmermann wrote:
> ...snip...
>> - Which leaves us with 1 common list where we don't have such
>> restrictive rules, and can continue with our cooperation: The
>> old/original OOo security list securityteam@openoffice.org.
> ...snip...
>
> To ask a practical question: is there anyone reading this email who is
> able to, and is willing to, manage the subscribers and archives for that
> list currently?
>
> Of not, the PPMC certainly needs to find such person ASAP so we know
> who's on the list, and so we can archive (privately) any ongoing list
> traffic someplace that has ASF Member and ooo-security@ oversight of the
> archive (at minimum, obviously any approved subscribers - from whatever
> organizatoins - should have some kind of archive access to the list).
>
> - Shane