www/security.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   2 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
   3 <html xmlns="http://www.w3.org/1999/xhtml">
   4 <head>
   5 <style type="text/css"> /* <![CDATA[ */
   6   @import "branding/css/tigris.css";
   7   @import "branding/css/inst.css";
   8   /* ]]> */</style>
   9 <link rel="stylesheet" type="text/css" media="print"
  10   href="branding/css/print.css"/>
  11 <script type="text/javascript" src="branding/scripts/tigris.js"></script>
  12 <title>Subversion Security</title>
  13 </head>
  14
  15 <body>
  16 <div class="app">
  17
  18 <h2>Subversion Security</h2>
  19
  20 <p>If you discover a security vulnerability in Subversion, please
  21 email:</p>
  22
  23 <!-- See http://www.cdt.org/speech/spam/030319spamreport.shtml for
  24      evidence that this has some effect. -->
  25 <blockquote>
  26 <p><strong>&#115;<span>&#101;&#099;&#117;</span>&#114;&#105;&#116;<span>&#121;&#064;&#115;&#117;&#098;&#118;&#101;</span>&#114;&#115;&#105;&#111;<span>&#110;</span>&#046;&#116;&#105;&#103;&#114;&#105;&#115;&#046;&#111;&#114;&#103;</strong></p>
  27 </blockquote>
  28
  29 <p>It is safe to send sensitive reports to this address.  List
  30 membership is controlled, and the archives are not publicly
  31 accessible.  We will analyze your report and take appropriate action.
  32 Our usual procedure is to</p>
  33
  34 <ol>
  35    <li>Make a fix for the vulnerability.</li>
  36
  37    <li>Discreetly distribute the fix to a few large sites that run
  38    Subversion servers and are trusted to be discreet themselves.</li>
  39
  40    <li>Release a new version of Subversion (containing just that fix)
  41    and publicly announce the vulnerability on the same day.</li>
  42 </ol>
  43
  44 <p>This procedure may vary depending on the nature of the
  45 vulnerability and the degree of pre-existing public awareness, of
  46 course.</p>
  47
  48 <p><span style="color: red"><i>Please do not reproduce the above email
  49 address on other web pages or in public postings.</i></span> Due to
  50 the need for responsiveness, the security list is unmoderated, which
  51 makes it particularly vulnerable to spammers.  Furthermore, we cannot
  52 easily change its address, even if the list were to start receiving
  53 spam, because it's too important to have a consistent, dependable
  54 place to report security holes.</p>
  55
  56 <p>On this page, the address has been encoded in various ways to
  57 reduce the likelihood of a spam harvester noticing it.  But if the
  58 address starts appearing in other places on the Internet, then the
  59 harvesters will inevitably pick it up, and we'll be stuck wading
  60 through ever-increasing amounts of spam, trying not to lose important
  61 vulnerability reports in the noise.</p>
  62
  63 </div>
  64 </body>
  65 </html>