Mailman 3 November 2013 - python-committers

Fwd: Re: Python at HackerOne
by Christian Heimes Nov. 8, 2013

Nov. 8, 2013

Forwarded mail -------- Original-Nachricht -------- Betreff: Re: Python at HackerOne Datum: Thu, 7 Nov 2013 16:37:30 -0800 Von: Alex Rice <arice(a)hackerone.com> An: Christian Heimes <christian(a)python.org> Kopie (CC): python-committers(a)python.org, IBB Panel <ibb-panel(a)hackerone.com> Hi Christian! Thanks for getting in touch, glad there's interest on your end! Our initial approach was structured to be as noninvasive as possible. The simple version: we'll keep an eye out for public security patches and reactively issue bounties for both the discovery & fix. This passive approach is optimized for minimizing pain but leaves room for efficiency gains given how removed we are from the project. Fortunately, we have a lot of flexibility here and we welcome assistance devising more effective means of rewarding outstanding security contributions to the Python community. Here are a few options worth mentioning: - Our initial scope only covers the rare, high-severity bugs, because we're a bottleneck that can't investigate every bug. This scope can be expanded if you're willing to accept more submissions and provide a severity assessment for confirmed bugs. For example, you might include low-severity bugs (i.e., DoS) for ~$500. - Please shout at us whenever you observe a contribution that you believe made us all safer. You will undoubtedly have insight into each vulnerability that we might have overlooked. - We're happy to make suggested edits to the program's description at https://hackerone.com/python In general, you're the boss: feel free to think of this as the "Python Bug Bounty". You tell us how the budget would be spent most effectively and we'll work with you to strike a balance. As examples, the guys at Phabricator decided to exclude bounties for patches (they'd rather fix every issue themselves) and rewrote most of our scope from scratch. Django is going through the same exercise right now. Thanks, Alex

1 0

Python at HackerOne
by Christian Heimes Nov. 7, 2013

Nov. 7, 2013

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi! I'm contacting you on behalf of the Python core committers and Python Security Response Team (PSRT). We were really excited and honored that Python was selected as one of the twelve first projects for the new Internet Bug Bounty program. Thanks a lot for including Python! Is there anything the PSRT or Python Software Foundation can do to join the effort and assist with your program? I think it's in our mutable interest to spread the word and handle incoming security issues properly. We will be glad to help you. Regards, Christian Heimes -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQIcBAEBCgAGBQJSe+w5AAoJEMeIxMHUVQ1FScgP/RFfopZobKp6Zm6m+/x3PLuK drN6qNFz+bVTP0OWBjuADLOIJHMH2Bg4BdhBaxwz0gFF+f4g6iqr5bI4VJRhaDiE Is99KzY7ZrMUy2OKC0MbrmbAxrWq8axmwel2u4wjCs/EH1qr794/fwExCEG8udzq 3KEzlBT5S+sxVvv8aXLeQX5fRyEAxr6saRtbXqThTZjL/MmZ0cb4f3eNfJDT4RTv SDHRjnAC/OtrGr5Qg+0y+qX7Qa7+YcMvQXGmNIFIrunbUCGiODtBJAx8xsjZNFDP 6N28CprnHYo2fLkDJTC//QhIpdS+dsrHtEhNih1cxw5ZjMf28MQNEenPjFx27S// gFkJC87JFV3cbWVFWZLM8j8im1tv+o2Ph09nrLj8QoApS5cgLB3LJXUy2b++rHOX cw5OM3BlQt701KpV3ATuPspWQEELqlKB7+gOeJEdd0+XUrEQfIEMdiT6fZOEOE+N qd+uPKRUNxxVC8kGne2GszhLXhHoeeBDK8EaTICr94Xw3ZVM8HaNBA6sykDdXEXn QX8OjSrXbW9iyS63Aru6KoUZS0PdHAzSHLDQbzRJUMtaE39kxVe5zfLovgaPY3dH zQnvotts5jvZ6K/G89dyNLqDRnGrZgPROKej1Uws82iah6GXO/3FTFSGrRmX4JUk /9xOzzkdBMjS1EF6/ca+ =oUpk -----END PGP SIGNATURE-----

1 0

Python bug bounty
by Christian Heimes Nov. 7, 2013

Nov. 7, 2013

Hi, this is going through the news right now. Has anybody contact us about the bug bounty program for Python? https://hackerone.com/python Christian

3 4

2.7.6
by Benjamin Peterson Nov. 3, 2013

Nov. 3, 2013

I know I said I would do Python 2.7.6 this weekend, but I became unexpectedly busy. I will plan to get to it in the next few days. -- Regards, Benjamin

1 0

Thank you
by Zachary Ware Nov. 3, 2013

Nov. 3, 2013

Hi all, Just wanted to briefly say thank you for the vote of confidence in accepting me into your ranks. I'm looking forward to working with such a great group of people on such a great project for a long time to come! Thanks, Zach Ware

4 3

Zachary Ware for commit access?
by Brian Curtin Nov. 1, 2013

Nov. 1, 2013

Hi all, What do you think about giving commit access to Zachary Ware? He's been active on the tracker for a while and has contributed a good bit of Windows code. I'm not doing much Windows stuff these days, and unfortunately I haven't had much time to contribute much lately. The latter will be changing, but the former probably won't. Anyways, Zach is interested in picking up some of our Windows slack and I think he could benefit from commit access. Although I've been mostly quiet, I have been nosy on most of his issues and have looked over most of the patches. I volunteer to continue looking after him as I too get back into contributing. Any thoughts?

7 6