[Python-Dev] Python security team

[Steve Holden]

Brett Cannon wrote:
> On Sat, Sep 27, 2008 at 8:54 AM, Victor Stinner
> <victor.stinner at haypocalc.com> wrote:
>> Hi,
>>
>> I would like to know if a Python security team does exist. I sent an email
>> about an imageop issue, and I didn't get any answer. Later I learned that a
>> security ticket was created, I don't have access to it.
>>
> 
> Yes, the PSRT (Python Security Response Team) does exist. We did get
> your email; sorry we didn't respond. There are very few members on
> that list and most of them are extremely busy. Responding to your
> email just slipped through the cracks. I believe Benjamin was the last
> person to work on your submitted patch.
> 
[...]

If we don't have a documented procedure, or if we do have a procedure
and it isn't being followed, we can't be said to be taking security
seriously, which I would find disappointing. This is one of the few
areas where we probably *do* need to be meticulous, and the absence of a
reply to a security report isn't really satisfactory.

Perhaps if the PSF does eventually hire some paid help, running the
secretarial and administrative portions of the security team would help
the busy members to avoid such issues dropping through the cracks in future.

regards
 Steve
-- 
Steve Holden        +1 571 484 6266   +1 800 494 3119
Holden Web LLC              http://www.holdenweb.com/