| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | Peter Eisentraut <peter_e(at)gmx(dot)net> |
| Cc: | Dawid Kuroczko <qnex42(at)gmail(dot)com>, Neil Conway <neilc(at)samurai(dot)com>, Josh Berkus <josh(at)agliodbs(dot)com>, pgsql-advocacy(at)postgresql(dot)org, Chris Travers <chris(at)travelamericas(dot)com>, pgsql-general <pgsql-general(at)postgresql(dot)org> |
| Subject: | Re: [GENERAL] MySQL worm attacks Windows servers |
| Date: | 2005-01-30 17:55:28 |
| Message-ID: | 3703.1107107728@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-advocacy pgsql-general pgsql-www |
Peter Eisentraut <peter_e(at)gmx(dot)net> writes:
> Dawid Kuroczko wrote:
>> I think it is in good taste that when you find a
>> bug/vulnerability/etc first you contact the author (in this case:
>> core), leave them some time to fix the problem and then go on
>> announcing it to the
>> world.
> In this case, core is not the author of the object in question. And of
> course, to report a "bug/vulnerability/etc" you would write to
> pgsql-bugs, not core.
Josh's point is that if you don't want to publicize a vulnerability
to the entire world in advance of there being any chance to fix it,
you don't send your report to an open, publicly-archived bugs list.
We don't really have an official security contact. The next best thing
is to send such reports to pgsql-core, which is not an open list, but
will reach a good chunk of those with an interest in fixing such
problems.
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Alvaro Herrera | 2005-01-30 19:44:59 | Re: [GENERAL] [pgsql-advocacy] MySQL worm attacks Windows servers |
| Previous Message | Dawid Kuroczko | 2005-01-30 16:41:08 | Re: [GENERAL] MySQL worm attacks Windows servers |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2005-01-30 18:05:15 | Re: changing sort_mem on the fly? |
| Previous Message | Mike-Olumide Johnson | 2005-01-30 17:48:51 | Freeradius and Postgresql |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Alvaro Herrera | 2005-01-30 19:44:59 | Re: [GENERAL] [pgsql-advocacy] MySQL worm attacks Windows servers |
| Previous Message | Dawid Kuroczko | 2005-01-30 16:41:08 | Re: [GENERAL] MySQL worm attacks Windows servers |