Who should security issues be reported to?

[Fredrik Lundh]

Nick Coghlan wrote:

>> I'm sorry, but this isn't really good enough. If Open Source wants to
>> say that they are better than these proprietary companies, they need
>> to deal with these sorts of things more professionally and establish
>> decent channels of communications for dealing with it.
>
> Is that the sound of a volunteer I hear?
>
> All you have to do is put your hand up, and the problem will be solved. If not you, who?

oh, please.  this is a security issue.  it needs a little more coordination
than an ordinary bug report.

</F>