From: Ian Campbell <ian.campbell@citrix.com>
Date: Thu, 16 Aug 2012 14:45:06 +0000 (+0100)
Subject: Discuss post-embargo disclosure of potentially controversial private decisions
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=a2fb85aeacea80adf1f3426e081f05bc097be599;p=people%2Flarsk%2Fsecurity-process.git

Discuss post-embargo disclosure of potentially controversial private decisions

See <20448.49637.38489.246434@mariner.uk.xensource.com>, section
    "11. Transparency"
---

diff --git a/security_vulnerability_process.html b/security_vulnerability_process.html
index 70356c6..b8ce69d 100644
--- a/security_vulnerability_process.html
+++ b/security_vulnerability_process.html
@@ -147,6 +147,18 @@ if(ns4)_d.write("<scr"+"ipt type=text/javascript src=/globals/mmenuns4.js><\/scr
        public advisory.  This will also be sent to the pre-disclosure
        list.</p>
     </li>
+
+    <li><p><b>Post embargo transparency:</b></p>
+    <p>During an embargo period the Xen.org security response team may
+    be required to make potentially controverial decisions in private,
+    since they cannot confer with the community without breaking the
+    embargo. The security team will attempt to make such decisions
+    following the guidance of this document and where necessary their
+    own best judgement. Following the embargo period any such
+    decisions will be disclosed to the community in the interests of
+    transparency and to help provide guidance should a similar
+    decision be required in the future.</p>
+    </li>
     </ol>
     
     <h2>Embargo and disclosure schedule</h2>