From: Ian Campbell <ian.campbell@citrix.com>
Date: Thu, 16 Aug 2012 14:11:18 +0000 (+0100)
Subject: Clarifications to predisclosure list subscription instructions
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=d9c5076331cc3ca7fb44f59c33fdca3554ec9cb9;p=people%2Flarsk%2Fsecurity-process.git

Clarifications to predisclosure list subscription instructions

Specially:
  * Mention that subscriptions via the webterface do not work / are
    not honoured.
  * Mention the preference for role addresses only.

See <20448.49637.38489.246434@mariner.uk.xensource.com>, section
    "8. Predisclosure subscription process, and email address
        criteria"
---

diff --git a/security_vulnerability_process.html b/security_vulnerability_process.html
index eff108a..0557556 100644
--- a/security_vulnerability_process.html
+++ b/security_vulnerability_process.html
@@ -206,7 +206,9 @@ if(ns4)_d.write("<scr"+"ipt type=text/javascript src=/globals/mmenuns4.js><\/scr
        <li>The planned disclosure date</li>
     </ul></p>
 
-    <p>Organisations who meet the criteria should contact security@xen if they wish to receive pre-disclosure of advisories.</p>    
+    <p>Organisations who meet the criteria should contact security@xen if they wish to receive pre-disclosure of advisories. Organisations should not request subscription via the mailing list web interface, any such subscription requests will be rejected and ignored.</p>
+    <p>Normally we would prefer that a role address be used for each organisation, rather than one or more individual's direct email address. This helps to ensure that changes of personnel do not end up effectively dropping an organisation from the list</p>
+
     <p>The pre-disclosure list will also receive copies of public advisories when they are first issued or updated.</p>
     
     <h3>Organizations on the pre-disclosure list:</h3>