|−|This policy describes how security related issues are handled after they have been reported to [mailto:firstname.lastname@example.org email@example.com]. |+|
|−|Issues that are brought to the attention of firstname.lastname@example.org are handled discretely. The issue will be verified and the author/maintainer of the affected code will usually be contacted. If the issue is indeed considered to be a problem the need for an immediate fix is assessed. The security team will notify also affected parties which are known to reuse the affected code. |+|
|−|If an immediate fix is not considered necessary a security alert is issued via http://dot.kde.org, bugtraq and [mailto:email@example.com firstname.lastname@example.org]. |+|
|−|If a fix is considered necessary, KDE release coordinators are contacted and KDE vendor packagers, Linux distributors and other prenotification mailing lists are informed once a fix is available that has passed review on [mailto:email@example.com firstname.lastname@example.org]. We then give them a reasonable amount of time to prepare binary packages. After that time we issue a security alert via dot.kde.org, bugtraq and [mailto:email@example.com firstname.lastname@example.org]. Patches in source form and any available updated binaries are published at the same time. |+|
|−|All security alerts are published on http://www.kde.org/info/security/. |+|
|−|KDE developers that want to join [mailto:email@example.com firstname.lastname@example.org] can send a motivated request to [mailto:email@example.com firstname.lastname@example.org]. Applications will be evaluated on a case by case basis by the current members. The main criteria is the extent to which someone can be helpful in executing the security policy as described here. That includes a willingness not to disclose issues prematurely. |+|
Latest revision as of 18:23, 10 March 2016
This page is now on the community wiki.
This page was last modified on 10 March 2016, at 18:23. Content is available under Creative Commons License SA 4.0
unless otherwise noted.