As some pointed out, the one who reports a security issue and the module maintainer(s) should be more involved in the fixing process:<br>1- better communication and transparency between reporters, maintainers and sec team<br>
2- less work for the sec team if the workflow is automated<br>3- leads to a quicker initial feedback from the sec team telling the reporter what to do, and preventing her from posting and advertising a fix in the issue queue or project page if she doesn't get a reply from
<a href="mailto:security@drupal.org">security@drupal.org</a> within the next hours...<br><br>all of that of course is restricted to the sec team and ppl involved in each security issue.<br><br>count me in too, but like DragonWize, not being able to lead. but if one can break things into smaller tasks, it'll be easier to give a hand.
<br><br>scor.<br><br><div class="gmail_quote">On Jan 20, 2008 4:15 PM, Jakob Petsovits <<a href="mailto:jpetso@gmx.at">jpetso@gmx.at</a>> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">On Saturday, 19. January 2008, Derek Wright wrote:<br>> On Jan 18, 2008, at 4:56 AM, Jakob Petsovits wrote:<br></div><div class="Ih2E3d">> > I'll try to be more silent next time.<br>><br>
</div>> [snip]<br><div class="Ih2E3d">> Please continue to contribute to these<br>> and other efforts, and by all means, don't be silent.<br><br></div>Mmkay!<br>:)<br><br>Thanks to *you* and your immense contributions,
<br><font color="#888888"> j<br></font></blockquote></div><br>