Making Community Decisions Without Consensus
summary
Xen faces the XSA‑7 SYSRET vulnerability and discovers its pre‑disclosure list (initially limited to public clouds with >300,000 nodes) lets a large provider miss a two‑week embargo and force a six‑week delay. The community runs an online discussion, then a structured five‑point survey adapted from conference selection methods, collects 33 responses, analyzes polarization to find a center of gravity, and changes policy to allow all public cloud providers on the pre‑disclosure list — proposal passes without a formal fallback vote.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:09What was the issue
- 5:50Vulnerability disclosure
- 10:24Trust
- 11:43Goals
- 14:18fallback
- 15:39online discussion
- 19:00summarize
- 25:16analysis
- 28:41proposal
- 30:06recap
- 30:30QA
- 34:10Does it make sense
- 40:48If people didnt take it seriously
related talks
19mXen Project 2024 Weather Report
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
36mState of Open Source in 2024
44mWhen Many Eyes Fail You
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
41mThe Year in Open Source Security
47m11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey
15mKeynote: Cutting Through the Fog: Clarifying CRA Compliance in Cloud Native