|
|
| (3 intermediate revisions by 3 users not shown) |
| Line 1: |
Line 1: |
| | | {{Moved To Community}} |
| | |
| Issues that are brought to the attention of [email protected] are handled discretely. The issue will be verified and the author/maintainer of the affected code will usually be contacted. If the issue is indeed considered to be a problem the need for an immediate fix is assessed. The security team will notify also affected parties which are known to reuse the affected code. | |
|
| |
| | |
|
| |
| If a fix is considered necessary, KDE release coordinators are contacted and KDE vendor packagers, Linux distributors and other prenotification mailing lists are informed once a fix is available that has passed review on [mailto:[email protected] [email protected]]. We then give them a reasonable amount of time to prepare binary packages. After that time we issue a security alert via dot.kde.org, bugtraq and [mailto:[email protected] [email protected]]. Patches in source form and any available updated binaries are published at the same time. | |
|
| |
| All security alerts are published on http://www.kde.org/info/security/.
| |
| | |
| KDE developers that want to join [mailto:[email protected] [email protected]] can send a motivated request to [mailto:[email protected] [email protected]]. Applications will be evaluated on a case by case basis by the current members. The main criteria is the extent to which someone can be helpful in excuting the security policy as described here. That includes a willingness not to disclose issues prematurely. | |
Latest revision as of 18:23, 10 March 2016
