[Starlingx-discuss] FW: May have to consider an lshell replacement

[Jones, Bruce E]

My bad, fixed now.

   brucej

-----Original Message-----
From: Young, Ken [mailto:Ken.Young at windriver.com] 
Sent: Thursday, September 27, 2018 1:38 PM
To: Jones, Bruce E <bruce.e.jones at intel.com>; Dean Troyer <dtroyer at gmail.com>; Saul Wold <sgw at linux.intel.com>
Cc: starlingx-discuss at lists.starlingx.io
Subject: Re: [Starlingx-discuss] FW: May have to consider an lshell replacement

Bruce,

Can you add the VMT team to the bug please?  I cannot open this.

Thanks!

/KenY

On 2018-09-27, 3:42 PM, "Jones, Bruce E" <bruce.e.jones at intel.com> wrote:

    Bug https://bugs.launchpad.net/starlingx/+bug/1794868 filed.  Saul and Dean added to it.
    
          brucej
    
    -----Original Message-----
    From: Young, Ken [mailto:Ken.Young at windriver.com] 
    Sent: Thursday, September 27, 2018 12:28 PM
    To: Dean Troyer <dtroyer at gmail.com>; Saul Wold <sgw at linux.intel.com>
    Cc: starlingx-discuss at lists.starlingx.io
    Subject: [Starlingx-discuss] FW: May have to consider an lshell replacement
    
    Dean / Saul,
    
    We agree that the all security issues are initially embargoed.  Therefore, this topic should not be discussed on the mailing list until it has been vetted by the security team.
    
    The security team has published a method to raise these issues.  You will find it here:
    
    https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_issues_to_Starling_X
    
    I would suggest that we open a Security launchpad and we can continue the discussion there.
    
    Thank you in advance.
    
    Regards,
    Ken Y
    
    On 2018-09-27, 3:07 PM, "Dean Troyer" <dtroyer at gmail.com> wrote:
    
        On Thu, Sep 27, 2018 at 12:45 PM, Jones, Bruce E
        <bruce.e.jones at intel.com> wrote:
        > What alternatives do we have for this functionality?
        
        Alternatives in increasing levels of commitment to lshell:
        * replace it
        * fork the project and fix the CVEs and continue
        * adopt the project and take over maintenance as a stand0-alone
        project should the existing maintainer be interested in doing so[0]
        
        I am specifically not listing 'do nothing' as active CVEs must be addressed...
        
        dt
        
        [0] OpenStack has done this on occasion when a dependency goes dormant
        and the maintainer has no interest in continuing and the cost of
        converting outweighs the perceived cost of maintenance and ownership.
        
        -- 
        
        Dean Troyer
        dtroyer at gmail.com
        
        _______________________________________________
        Starlingx-discuss mailing list
        Starlingx-discuss at lists.starlingx.io
        http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
        
    
    _______________________________________________
    Starlingx-discuss mailing list
    Starlingx-discuss at lists.starlingx.io
    http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss