►
From YouTube: OpenSSF Vulnerability Disclosures (July 5, 2023)
Description
Meeting minutes: https://docs.google.com/document/d/1jzqhW9SK9QRA39fQz0RiAkvpRWB0xztt1TAFJEseTlA
Repo: https://github.com/ossf/wg-vulnerability-disclosures
A
B
C
D
F
B
B
B
C
B
B
D
F
E
D
G
B
B
B
C
E
A
B
B
G
E
G
Defeat
p.m:
P
VR
is
able,
then,
in
that
case,
let's
see
the
we
can
just
like.
Let
them
know
about
the
vulnerability
and
fix
it
immediately
and
then
the
other
one
was
if
it's
not
unable
and
the
issue
is
disabled
and
the
disclosure
email
can
be
found
in
this
case,
we
want
to
like
create
a
public.
Well,
what
I
understood
is
that
we
create
a
public
pull
request
to
notify
the
maintainer.
B
F
B
B
C
B
B
To
request
yes:
well,
so
the
repository
host
does
not
support
pmbvr.
So
there's
a
difference
here:
the
if
the
repository
post
doesn't
support
pmpvr,
that's
like
GitHub,
GitHub
or
gitlab,
or
bitbucket
non-sporting
pmpvr.
So
if
the
host
doesn't
support
it,
then
they
may
spend
the
repository
can't
turn
it
on,
because
they
mean
because
the
the
code
base
itself
does
like
the
the
where.
C
B
B
A
patch
it's
means
two
things
kind
of
so
in
the
general
sense
of
patch
means
a
contribution,
but
a
patch
file
which
is
dot
p-a-t-c-h,
is
a
standard
format
for
defining
a
diff
that
is
like
from
what
currently
the
code
is
the
diff
to
what
we
want
it
to
be
is
a
standard
format
of
dot
patch
files
that
tooling,
like
git
and
other
other
other
things.
Can
you
be
be
used
to
apply
get
commits
when
you
see
the
commits
commits
are
always
in
patch
format.
B
B
E
B
B
F
B
B
B
F
B
B
E
G
B
B
B
E
B
E
B
B
B
E
B
All
right,
3.1.1
pmpvr,
is
enabled
in
a
case
where
the
repository
hosts,
Sports
pmpvr
and
the
repository
has
its
enabled
then
vulner,
then
the
vulnerability
and
the
fix
will
be
provided
immediately
by
a
PM.
Pbr
pmpvr
is
not
enabled.
Issues
are
disabled
and
disclosure.
Emails
can't
be
found
in
a
case
where
the
repository
pmpvr
is
not
enabled.
D
B
F
B
D
D
F
E
B
Email
and
hit
the
issue
tracker
requesting
pmpvrv
enabled
the
email
also
include
the
patch
with
default
fiction
for
the
vulnerability
3.1.3.1,
if
pmpvr,
if
within
90
days
of
contacting
the
maintainers,
if
VR
is,
enabled
contribute
the
patch
by
a
private
pull
request,
leveraging
PMB
VR
3.1.3.2.
If
the
vulnerability
is
not
fixed
after
90
days,
then
create
a
public
pull
request.
B
B
B
D
D
B
B
B
D
A
B
B
B
B
B
That
was
an
opinion
from
I
was
of
the
opinion
that
we
should
just
just
do
nothing
and
or
publicly
disclose.
It
was
the
opponent
opinion
of
Jordan
her
that
there
may
be
repositories
out
there
that
there
may
be.
There
may
be
repositories
out
there
that
are
archived,
but
the
maintainers
still
care
about.
B
C
D
A
A
D
F
B
E
A
F
A
A
E
D
E
B
Are
easily
detractable
and
fixes
and
the
fix
can
be
entirely
automated.
In
these
cases,
the
scope
of
the
vulnerability
is
often
beyond
what
can
be
reasonably
reported
to
meet
each
maintainer
privately
in
a
one-on-one
Exchange,
essentially
automated
they
created
a
creation
of
thousands
of
bug.
Reports
also
isn't
useful
element
even
more
of
our
non-volunteer
maintainers,
of
open
social
projects.
A
B
F
A
D
B
B
B
F
B
E
B
Coordinated
on
it,
not
automated
private
disclosure,
yada
yada,
basically
limiting
it
to
like
you
know
if
it's
new
or
novel,
you
better
disclose
privately,
but
if
it's
not
new
or
novel,
go
for
it.
Pirates
closure.
If
you
open,
SF,
closing
provider
Sports
a
pragmatic
means
of
private
disclosure,
for
example,.