Profile cover photo
Profile photo
Marcus Krause
90 followers -
Sometimes you win, sometimes you learn.
Sometimes you win, sometimes you learn.

90 followers
About
Marcus's posts

Post has shared content
Regarding the time (day of week) for publishing security advisories: 

1. It is complicated enough (most likely impossible) to find a time which pleases anyone (think of different deployment cycles or time zones).

2. Even if we find great agreement on a specific time, there will be (many) exceptions anyway due to (lack of) team resources and the severity of vulnerability that was found.

3. The more critical a vulnerability is, the more likely publication makes sense on an arbitrary day of the week; the less critical it is, the less important it is for you to act immediately, so that the day of publication does not matter much anyway.

4. Our (small) team has a lot of experience in security topics and we have absolutely no interest in doing something bad for our users. The day of publication has been discussed multiple times with the same result: We as experts have to consider all options (from the above) and decide case by case when to publish an advisory. Some times this will be on a weekend or right before a weekend.

Please trust our teams' decisions. Thanks!

P.S.: Other OSS projects publish advisories on saturday evenings and I consider this is also to be fine from a security perspective.

#TYPO3   #Security   #SecurityTeam   #Advisories  

Post has attachment
Mark this date: my first hybris Commerce Suite installation.
Photo

Post has shared content

Post has attachment
Nike und Yuna bei e-net
PhotoPhotoPhotoPhotoPhoto
e-net dogs
20 Photos - View album

Post has attachment
PIXAR - 25 years of Animation - exhibition at Museum für Kunst und Gewerbe, Hamburg, Germany
PhotoPhotoPhotoPhotoPhoto
25 years of PIXAR
5 Photos - View album

Post has shared content

Post has attachment
PhotoPhotoPhotoPhoto
BlackBerry Jam Europe 2013
4 Photos - View album

Post has shared content
Early bird tickets are now available at droidcon.de/2013/tickets. Don't worry that my profile image is still 2012. It is more important that you get the update than I get a new outfit.

Post has attachment
Wait while more posts are being loaded