Dean / Saul, We agree that the all security issues are initially embargoed. Therefore, this topic should not be discussed on the mailing list until it has been vetted by the security team. The security team has published a method to raise these issues. You will find it here: https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is... I would suggest that we open a Security launchpad and we can continue the discussion there. Thank you in advance. Regards, Ken Y On 2018-09-27, 3:07 PM, "Dean Troyer" <dtroyer@gmail.com> wrote: On Thu, Sep 27, 2018 at 12:45 PM, Jones, Bruce E <bruce.e.jones@intel.com> wrote: > What alternatives do we have for this functionality? Alternatives in increasing levels of commitment to lshell: * replace it * fork the project and fix the CVEs and continue * adopt the project and take over maintenance as a stand0-alone project should the existing maintainer be interested in doing so[0] I am specifically not listing 'do nothing' as active CVEs must be addressed... dt [0] OpenStack has done this on occasion when a dependency goes dormant and the maintainer has no interest in continuing and the cost of converting outweighs the perceived cost of maintenance and ownership. -- Dean Troyer dtroyer@gmail.com _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss