Security testing: need for a security policy, and a security-critical package process

[Adam Williamson]

On Tue, 2009-11-24 at 15:44 -0500, Bill Nottingham wrote:
> Adam Williamson (awilliam at redhat.com) said: 
> > > > It's true, but note that the XO software is technically a "Remix"
> > > > rather than a "Spin", so there aren't any technical requirements
> > > > on it to satisfy the use of the Fedora mark.  (I think I'd agree
> > > > with Greg's point regarding official Fedora spins.)
> > > 
> > > But if it was such a concern with respect to the Fedora brand and
> > > image, I would think the same argument would apply, even if it
> > > was just branded as a 'Fedora remix'. 
> > 
> > SoaS is not Fedora-branded in any way, AFAIK.
> 
> Yes, but how often have we touted XO, Sugar, et. al. as being 'based
> on Fedora' over the past 4 years? Heck, you could argue it's gotten
> more press than some of our official spins.

I dunno, but as an outsider for most of those 4 years I never remotely
considered Sugar or XO or SoaS to be 'Fedora projects' and wouldn't have
tied any problems with them into the image of 'the Fedora project', for
what that's worth.

-- 
Adam Williamson
Fedora QA Community Monkey
IRC: adamw | Fedora Talk: adamwill AT fedoraproject DOT org
http://www.happyassassin.net