You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Costin Manolache <cm...@yahoo.com> on 2002/10/14 19:24:27 UTC
[VOTE] tomcat-commiters list
I would like to propose a new mailing list.
The list will be closed to commiters only. The main purpose
will be discussions of security and other special issues.
This should avoid [Cc] threads.
The main target should be active commiters - so it should
start empty.
This is a majority vote.
[ ] I agree with the proposal
[ ] I don't agree with the proposal
--
Costin
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Jean-Francois Arcand <jf...@apache.org>.
Costin Manolache wrote:
>I would like to propose a new mailing list.
>
>The list will be closed to commiters only. The main purpose
>will be discussions of security and other special issues.
>This should avoid [Cc] threads.
>
>The main target should be active commiters - so it should
>start empty.
>
>This is a majority vote.
>
>[X] I agree with the proposal
>[ ] I don't agree with the proposal
>
>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Remy Maucherat <re...@apache.org>.
Costin Manolache wrote:
> I would like to propose a new mailing list.
>
> The list will be closed to commiters only. The main purpose
> will be discussions of security and other special issues.
> This should avoid [Cc] threads.
>
> The main target should be active commiters - so it should
> start empty.
>
> This is a majority vote.
>
> [X] I agree with the proposal
> [ ] I don't agree with the proposal
>
Remy
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Bojan Smojver <bo...@rexursive.com>.
On Tue, 2002-10-15 at 03:24, Costin Manolache wrote:
> I would like to propose a new mailing list.
>
> The list will be closed to commiters only. The main purpose
> will be discussions of security and other special issues.
> This should avoid [Cc] threads.
>
> The main target should be active commiters - so it should
> start empty.
>
> This is a majority vote.
>
> [X] I agree with the proposal
> [ ] I don't agree with the proposal
>
> --
> Costin
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Ian Darwin <ia...@darwinsys.com>.
> > The list will be closed to commiters only. The main purpose
> > will be discussions of security and other special issues.
> > This should avoid [Cc] threads.
> >
> > The main target should be active commiters - so it should
> > start empty.
> >
> > This is a majority vote.
> >
> > [X ] I agree with the proposal
> > [ ] I don't agree with the proposal
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Henri Gomez <hg...@apache.org>.
Costin Manolache wrote:
> I would like to propose a new mailing list.
>
> The list will be closed to commiters only. The main purpose
> will be discussions of security and other special issues.
> This should avoid [Cc] threads.
>
> The main target should be active commiters - so it should
> start empty.
>
> This is a majority vote.
>
> [ ] I agree with the proposal
> [ ] I don't agree with the proposal
I agree if it cover only discussions about security, but
discussions and features should stay in tomcat-dev.
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Bob Schulze <de...@netscape.net>.
[X] I agree with the proposal
[ ] I don't agree with the proposal
Fine for another non-committer.
PLS cont. to read the dev list too ;-)
Bob
Costin Manolache wrote:
> I would like to propose a new mailing list.
>
> The list will be closed to commiters only. The main purpose
> will be discussions of security and other special issues.
> This should avoid [Cc] threads.
>
> The main target should be active commiters - so it should
> start empty.
>
> This is a majority vote.
>
> [ ] I agree with the proposal
> [ ] I don't agree with the proposal
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Chuck Murcko <ch...@topsail.org>.
On Monday, October 14, 2002, at 01:40 PM, Costin Manolache wrote:
> Chuck Murcko wrote:
>
>> There's currently a call for project committers to be on the
>> security@apache.org list. This list intends to be the clearinghouse for
>> all ASF project related security issues, not just httpd.
>>
>> Costin, Craig, et al.: the deal seems to be that each major project
>> version have someone who's a committer subscribed as a project liason.
>> So it might make sense if you both signed up, or if other committers
>> wanted to step forward...I would leave that to you all to figure out.
>>
>> Not to short-circuit a Tomcat committers list, because there may well
>> be
>> issues other than security to deal with, and it would make sense to
>> have
>> information flow between security@ and a proposed tomcat-committers@
>> anyway (I'm thinking the detailed hashing of fixes would happen on the
>> latter list).
>
> Regarding security@apache.org - I think that all who play the role of
> release manager should be on the list ( i.e. Remy, Larry, Mladen,
> Henri).
> It seems to be open for a limited number of 'liasons' ( I hope it
> is more than one, as we have several major components ).
>
> My preference is that any tomcat commiter who is interested to be able
> to get this info and discuss ( and hopefully fix ) tomcat security
> issues. I hope that whoever gets the security messages will fix them or
> forward them to tomcat-commiters - but that's of course his choice.
>
> If the apache list is open to any commiter - I'll certainly subscribe
> ( and I hope most active tomcat commiters will do the same ! ),
> but that doesn't remove the need for a private list for tomcat
> commiters.
>
Yes, the security list is open to all committers, and it is not a 1:1
mapping of projects to committers/subscribers. Definitely all the RMs
should be on it, as well as interested committers from each
project/major component. I should have said "at least one" somewhere
before, especially if a fix needs to get rolled out quickly and
precisely.
As for other issues needing a private and local (to Tomcat) list, I must
leave that to you all to decide. After thinking about it a bit more MHO
is that a separate committers list really sounds equivalent to having
committer participation on the PMC list for jakarta, if that is possible.
Chuck
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Costin Manolache <cm...@yahoo.com>.
Chuck Murcko wrote:
> There's currently a call for project committers to be on the
> security@apache.org list. This list intends to be the clearinghouse for
> all ASF project related security issues, not just httpd.
>
> Costin, Craig, et al.: the deal seems to be that each major project
> version have someone who's a committer subscribed as a project liason.
> So it might make sense if you both signed up, or if other committers
> wanted to step forward...I would leave that to you all to figure out.
>
> Not to short-circuit a Tomcat committers list, because there may well be
> issues other than security to deal with, and it would make sense to have
> information flow between security@ and a proposed tomcat-committers@
> anyway (I'm thinking the detailed hashing of fixes would happen on the
> latter list).
Regarding security@apache.org - I think that all who play the role of
release manager should be on the list ( i.e. Remy, Larry, Mladen, Henri).
It seems to be open for a limited number of 'liasons' ( I hope it
is more than one, as we have several major components ).
My preference is that any tomcat commiter who is interested to be able
to get this info and discuss ( and hopefully fix ) tomcat security
issues. I hope that whoever gets the security messages will fix them or
forward them to tomcat-commiters - but that's of course his choice.
If the apache list is open to any commiter - I'll certainly subscribe
( and I hope most active tomcat commiters will do the same ! ),
but that doesn't remove the need for a private list for tomcat
commiters.
Costin
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Chuck Murcko <ch...@topsail.org>.
There's currently a call for project committers to be on the
security@apache.org list. This list intends to be the clearinghouse for
all ASF project related security issues, not just httpd.
Costin, Craig, et al.: the deal seems to be that each major project
version have someone who's a committer subscribed as a project liason.
So it might make sense if you both signed up, or if other committers
wanted to step forward...I would leave that to you all to figure out.
Not to short-circuit a Tomcat committers list, because there may well be
issues other than security to deal with, and it would make sense to have
information flow between security@ and a proposed tomcat-committers@
anyway (I'm thinking the detailed hashing of fixes would happen on the
latter list).
Just my $0.02.
Chuck
On Monday, October 14, 2002, at 12:14 PM, Costin Manolache wrote:
> Bill Barker wrote:
>
>>> I would like to propose a new mailing list.
>>>
>>> The list will be closed to commiters only. The main purpose
>>> will be discussions of security and other special issues.
>>> This should avoid [Cc] threads.
>>>
>>> The main target should be active commiters - so it should
>>> start empty.
>>>
>>> This is a majority vote.
>>>
>>> [ ] I agree with the proposal
>>> [X] I don't agree with the proposal
>>
>> Security holes don't occur often enough to bother with maintaining the
>> "active committers" list, and there isn't much point in the list
>> otherwise. Plus, segregating the security concerns simply would make
>> the
>> mbox archives a must-bookmark for every black-hat. :)
>
> Aparently they do occur more often than we would like. And I've been
> in at least 4 Cc: chains in the last 2 months. Whoever is in the
> the apache security list or PMC should forward tomcat security
> problems to a known address where it can be addressed.
>
> It is not only for security - but any issue that we might consider
> 'private' ( again, it is better than using the Cc: ).
>
>
> --
> Costin
>
>
>
> --
> To unsubscribe, e-mail: <mailto:tomcat-dev-
> unsubscribe@jakarta.apache.org>
> For additional commands, e-mail: <mailto:tomcat-dev-
> help@jakarta.apache.org>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Costin Manolache <cm...@yahoo.com>.
Bill Barker wrote:
>> I would like to propose a new mailing list.
>>
>> The list will be closed to commiters only. The main purpose
>> will be discussions of security and other special issues.
>> This should avoid [Cc] threads.
>>
>> The main target should be active commiters - so it should
>> start empty.
>>
>> This is a majority vote.
>>
>> [ ] I agree with the proposal
>> [X] I don't agree with the proposal
>
> Security holes don't occur often enough to bother with maintaining the
> "active committers" list, and there isn't much point in the list
> otherwise. Plus, segregating the security concerns simply would make the
> mbox archives a must-bookmark for every black-hat. :)
Aparently they do occur more often than we would like. And I've been
in at least 4 Cc: chains in the last 2 months. Whoever is in the
the apache security list or PMC should forward tomcat security
problems to a known address where it can be addressed.
It is not only for security - but any issue that we might consider
'private' ( again, it is better than using the Cc: ).
--
Costin
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Bill Barker <wb...@wilshire.com>.
----- Original Message -----
From: "Costin Manolache" <cm...@yahoo.com>
To: <to...@jakarta.apache.org>
Sent: Monday, October 14, 2002 10:24 AM
Subject: [VOTE] tomcat-commiters list
> I would like to propose a new mailing list.
>
> The list will be closed to commiters only. The main purpose
> will be discussions of security and other special issues.
> This should avoid [Cc] threads.
>
> The main target should be active commiters - so it should
> start empty.
>
> This is a majority vote.
>
> [ ] I agree with the proposal
> [X] I don't agree with the proposal
Security holes don't occur often enough to bother with maintaining the
"active committers" list, and there isn't much point in the list otherwise.
Plus, segregating the security concerns simply would make the mbox archives
a must-bookmark for every black-hat. :)
>
> --
> Costin
>
>
>
> --
> To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
> For additional commands, e-mail:
<ma...@jakarta.apache.org>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Glenn Nielsen <gl...@mail.more.net>.
Costin Manolache wrote:
> I would like to propose a new mailing list.
>
> The list will be closed to commiters only. The main purpose
> will be discussions of security and other special issues.
> This should avoid [Cc] threads.
>
> The main target should be active commiters - so it should
> start empty.
>
> This is a majority vote.
>
> [X] I agree with the proposal
> [ ] I don't agree with the proposal
>
Glenn
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: [VOTE] tomcat-commiters list
Posted by Amy Roh <am...@apache.org>.
Costin Manolache wrote:
> I would like to propose a new mailing list.
>
> The list will be closed to commiters only. The main purpose
> will be discussions of security and other special issues.
> This should avoid [Cc] threads.
>
> The main target should be active commiters - so it should
> start empty.
>
> This is a majority vote.
>
> [X] I agree with the proposal
> [ ] I don't agree with the proposal
>
Amy
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: [VOTE] tomcat-commiters list
Posted by Mladen Turk <mt...@mappingsoft.com>.
>
> The main target should be active commiters - so it should
> start empty.
>
> This is a majority vote.
>
[x] I agree with the proposal
[ ] I don't agree with the proposal
MT
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>