Security release criterion proposal

[Kevin Kofler]

Adam Jackson wrote:
> The difference between a known and an unknown security bug is that, if
> _you_ know about it, it's virtually certain that someone malicious
> already does too.
> 
> We can't avoid unknown risk exposure.  You're arguing for ignoring known
> risk exposure entirely.  Seems a touch irresponsible.

"Unknown" risk exposure can become known after the release and we'd have to 
respin all our images for every single security fix to address that. This is 
just not practical.

> Also: twelve month.

13 months if you go by that metric, but the 6 months I mentioned are the 
time between 2 releases, i.e. the time that can pass in the worst case until 
we release fixed images.

        Kevin Kofler