Packager responsibilities and violation of trust

[Ethan Blanton]

Ionut,

It appears likely that you have violated our trust in belonging to the
packagers list for Pidgin, which receives security vulnerability
information ahead of time so that distributions may prepare for
coordinated release of vulnerability fixes.  This URL was brought to
our attention on packagers (of which you are probably aware):

    http://repos.archlinux.org/wsvn/packages/pidgin/?op=revision&rev=85620

That patch was an embargoed (until August 5, when the coordinated
2.7.2 release was to occur) fix for an as-yet-undisclosed security
vulnerability.  By releasing the patch before the embargo date, you
have compromised the disclosure process, preventing other packagers
and vendors from responsibly patching their distributions of
Pidgin/libpurple to be released on the day of the vulnerability
announcement.

You were allowed onto packagers at pidgin.im on the condition that you
keep the information on that list private and secure, so that you
could release coordinated fixes for Arch Linux.

I do not have any immediate plans to remove you from the packagers
list, but we will certainly be discussing this situation.  I trust
that, in the meantime, you will not disclose any more information from
that list until you are explicitly allowed to do so.

Ethan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 482 bytes
Desc: Digital signature
URL: <http://pidgin.im/cgi-bin/mailman/private/security/attachments/20100719/bad4d286/attachment.pgp>