Permalink
Browse files

[1.3.X] Updated the contributing document to accurately reflect our s…

…ecurity process.

Backport of [16032] from trunk.

git-svn-id: http://code.djangoproject.com/svn/django/branches/releases/1.3.X@16033 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
1 parent cdd75e0 commit 9b21a0c92132f5b5c9c8ca33fba88c1eab2f2933 @jacobian jacobian committed Apr 17, 2011
Showing with 7 additions and 7 deletions.
  1. +7 −7 docs/internals/contributing.txt
@@ -104,19 +104,19 @@ following actions:
fix is forthcoming. We'll give a rough timeline and ask the reporter
to keep the issue confidential until we announce it.
- * Halt all other development as long as is needed to develop a fix,
- including patches against the current and two previous releases.
+ * Focus on developing a fix as quickly as possible and produce patches
+ against the current and two previous releases.
* Determine a go-public date for announcing the vulnerability and the fix.
To try to mitigate a possible "arms race" between those applying the
patch and those trying to exploit the hole, we will not announce
security problems immediately.
- * Pre-notify everyone we know to be running the affected version(s) of
- Django. We will send these notifications through private e-mail
- which will include documentation of the vulnerability, links to the
- relevant patch(es), and a request to keep the vulnerability
- confidential until the official go-public date.
+ * Pre-notify third-party distributors of Django ("vendors"). We will send
+ these vendor notifications through private email which will include
+ documentation of the vulnerability, links to the relevant patch(es), and a
+ request to keep the vulnerability confidential until the official
+ go-public date.
* Publicly announce the vulnerability and the fix on the pre-determined
go-public date. This will probably mean a new release of Django, but

0 comments on commit 9b21a0c

Please sign in to comment.