Re: Clarification on embargoed testing in a partner cloud

[Jeremy Stanley <fungi () yuggoth org>]

On 2023-05-24 07:26:42 -0700 (-0700), Anthony Liguori wrote:
[...]
> For list members that have questions about AWS, I'm happy to
> answer, in gory details.  I know other large cloud providers have
> folks on the list that would likely offer the same (or at least
> direct to the appropriate people).  I can also help make
> connections to most of the large cloud providers if folks don't
> have contacts.

I'm similarly happy to connect interested parties to contacts at the
hundreds of public cloud service providers who run OpenStack, if
there are questions along those lines.

> That said, I don't think this is the most important part of the
> discussion...
[...]

Agreed.

With my upstream developer and vulnerability coordinator hat on, I
don't mind if downstream stakeholders who are given advance notice
of our upcoming advisories test the included patches on resources in
"public clouds" (whatever that term really means), as long as
they're reasonably confident in the contractual relationships they
have with those providers to operate ethically and above board. But
also, we intentionally don't open up our embargoed discussions to
downstream distributors until fairly close to the planned
publication date, in order to limit the blast radius from accidental
leaks.

Perhaps unsurprisingly, the OpenStack community does perform
basically all of its testing and vulnerability management tasks on
donated resources within OpenStack-based cloud providers, so it
would be somewhat hypocritical of us to tell our users they
shouldn't. I get the impression an increasing number of open source
projects do the same today.
-- 
Jeremy Stanley

Attachment: signature.asc
Description: