Security release criterion proposal

Kevin Kofler kevin.kofler at
Wed May 18 20:37:27 UTC 2011

Adam Jackson wrote:
> The difference between a known and an unknown security bug is that, if
> _you_ know about it, it's virtually certain that someone malicious
> already does too.
> We can't avoid unknown risk exposure.  You're arguing for ignoring known
> risk exposure entirely.  Seems a touch irresponsible.

"Unknown" risk exposure can become known after the release and we'd have to 
respin all our images for every single security fix to address that. This is 
just not practical.

> Also: twelve month.

13 months if you go by that metric, but the 6 months I mentioned are the 
time between 2 releases, i.e. the time that can pass in the worst case until 
we release fixed images.

        Kevin Kofler

More information about the devel mailing list