[Starlingx-discuss] FW: May have to consider an lshell replacement

Young, Ken Ken.Young at windriver.com
Thu Sep 27 19:28:28 UTC 2018


Dean / Saul,

We agree that the all security issues are initially embargoed.  Therefore, this topic should not be discussed on the mailing list until it has been vetted by the security team.

The security team has published a method to raise these issues.  You will find it here:

https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_issues_to_Starling_X

I would suggest that we open a Security launchpad and we can continue the discussion there.

Thank you in advance.

Regards,
Ken Y

On 2018-09-27, 3:07 PM, "Dean Troyer" <dtroyer at gmail.com> wrote:

    On Thu, Sep 27, 2018 at 12:45 PM, Jones, Bruce E
    <bruce.e.jones at intel.com> wrote:
    > What alternatives do we have for this functionality?
    
    Alternatives in increasing levels of commitment to lshell:
    * replace it
    * fork the project and fix the CVEs and continue
    * adopt the project and take over maintenance as a stand0-alone
    project should the existing maintainer be interested in doing so[0]
    
    I am specifically not listing 'do nothing' as active CVEs must be addressed...
    
    dt
    
    [0] OpenStack has done this on occasion when a dependency goes dormant
    and the maintainer has no interest in continuing and the cost of
    converting outweighs the perceived cost of maintenance and ownership.
    
    -- 
    
    Dean Troyer
    dtroyer at gmail.com
    
    _______________________________________________
    Starlingx-discuss mailing list
    Starlingx-discuss at lists.starlingx.io
    http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
    



More information about the Starlingx-discuss mailing list