Changes between Version 4 and Version 5 of SecurityVulnerabilityProcess

Timestamp:

Sep 22, 2009, 2:17:09 PM (14 years ago)

Author:

datallah

Comment:

Fix formatting

SecurityVulnerabilityProcess

@@ -5 +5 @@
 
 = Process for Developers =
- 1.
-  a) When a bug is reported to the security@pidgin.im mailing list, reply to the reporter with an email based on this template:
-     Thank you for reporting this problem to us!  We will investigate it and make an appropriate fix.  In the mean time, we ask that you please not disclose the problem to the public, yet!  Please provide us with the following information: TODO
-  b) If the bug has already been announced publicly (on devel mailing list, IRC, or Jabber conference), send all information about the bug to security@pidgin.im
- 2. Developers on the security email list should determine an appropriate fix and create a patch.
+ 1. Acknowledge receipt of the bug.
+   a. When a bug is reported to the security@pidgin.im mailing list, reply to the reporter with an email based on this template:
+{{{
+ Thank you for reporting this problem to us!
+ We will investigate it and make an appropriate fix.
+ In the mean time, we ask that you please not disclose the problem to the public, yet!
+ Please provide us with the following information: TODO
+}}}
+   a. If the bug has already been announced publicly (on devel mailing list, IRC, or Jabber conference), send all information about the bug to security@pidgin.im
+ 1. Developers on the security email list should determine an appropriate fix and create a patch.
  1. Once an agreed upon patch has been created, an email based on this template should be sent to the packagers mailing list:
-  Subject: Security Vulnerability
-  Body: A security vulnerability has been discovered in [Pidgin|Finch|libpurple|other]
-  Affected software: [e.x. "Pidgin 2.4.2-2.6.0", or "All clients based on libpurple 2.3.3-2.3.7"]
-  Discovered by: [Name of company or individual]
-  Public: ["no" or "yes as of YYYY-MM-DD"]
-  Embargo date: [Either "none" or the agreed upon date]
+{{{
+ Subject: Security Vulnerability
+ Body: A security vulnerability has been discovered in [Pidgin|Finch|libpurple|other]
+ Affected software: [e.x. "Pidgin 2.4.2-2.6.0", or "All clients based on libpurple 2.3.3-2.3.7"]
+ Discovered by: [Name of company or individual]
+ Public: ["no" or "yes as of YYYY-MM-DD"]
+ Embargo date: [Either "none" or the agreed upon date]
+}}}
  1. Announce to the world, create new packages, update security page