[Python-Dev] Python security team (original) (raw)

Steve Holden steve at holdenweb.com
Sun Sep 28 15:39:40 CEST 2008

Brett Cannon wrote:

On Sat, Sep 27, 2008 at 8:54 AM, Victor Stinner <victor.stinner at haypocalc.com> wrote:

Hi,

I would like to know if a Python security team does exist. I sent an email about an imageop issue, and I didn't get any answer. Later I learned that a security ticket was created, I don't have access to it. Yes, the PSRT (Python Security Response Team) does exist. We did get your email; sorry we didn't respond. There are very few members on that list and most of them are extremely busy. Responding to your email just slipped through the cracks. I believe Benjamin was the last person to work on your submitted patch. [...]

If we don't have a documented procedure, or if we do have a procedure and it isn't being followed, we can't be said to be taking security seriously, which I would find disappointing. This is one of the few areas where we probably do need to be meticulous, and the absence of a reply to a security report isn't really satisfactory.

Perhaps if the PSF does eventually hire some paid help, running the secretarial and administrative portions of the security team would help the busy members to avoid such issues dropping through the cracks in future.

regards Steve

Steve Holden +1 571 484 6266 +1 800 494 3119 Holden Web LLC http://www.holdenweb.com/

More information about the Python-Dev mailing list