<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Apologies for not copying the [ptl] tag, since this change affects mostly the PTLs and the projects for which they facilitate. </div>
<div><br>
</div>
<div>Note PTL's the purpose of this change is to make your lives easier and streamline the VMT application process, but keep the spirit of the original requirement in place. Given that this change is to help make he lives of the PTL and security team easier,
if both could weigh in ion the review, I'd appreciate it. I'd like to get the language correct so we don't have to keep changing section 5 of this tag or special case it to death since that is an anti-pattern in the governance repository.</div>
<div><br>
</div>
<div>If PTLs, project partiicipants, or anyone else for that matter have any wording changes, feel free to propose them – IANAL and writing these things correctly is hard to do properly ); involving the community around the pain points of the tagging process
is what I'm after.</div>
<div><br>
</div>
<div>Regards</div>
<div>-steve</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Steven Dake <<a href="mailto:stdake@cisco.com">stdake@cisco.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Date: </span>Friday, April 1, 2016 at 5:04 PM<br>
<span style="font-weight:bold">To: </span>"OpenStack Development Mailing List (not for usage questions)" <<a href="mailto:openstack-dev@lists.openstack.org">openstack-dev@lists.openstack.org</a>><br>
<span style="font-weight:bold">Subject: </span>[openstack-dev] [security][tc] Tidy up language in section 5 of the vulnerability:managed tag<br>
</div>
<div><br>
</div>
<blockquote id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE" style="BORDER-LEFT: #b5c4df 5 solid; PADDING:0 0 0 5; MARGIN:0 0 0 5;">
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div style="font-family: Calibri, sans-serif; font-size: 14px;">Please see my review here as requested in this thread [1]:</div>
<div>
<p style="font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;">
<a href="https://review.openstack.org/300698">https://review.openstack.org/300698</a></p>
<p style="font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;">
<br>
</p>
<p style="font-family: Menlo; font-size: 11px; margin: 0px; line-height: normal;">
The purpose of this review is two fold:</p>
<ol style="font-family: Calibri, sans-serif; font-size: 14px;">
<li>Permit sponsoring companies of single vendor projects or projects with low company affiliation diversity to allow their own security experts to sign off on a threat analysis, acting as a third party..</li><li>Enable scaling of the OSSA and VMT processes by permitting projects to self-audit, self-review, or self-threat analyze with the condition that an impartial third party take responsibility for approving the audit, review, or threat analysis.</li></ol>
<div>[1] <a href="http://lists.openstack.org/pipermail/openstack-dev/2016-March/091075.html">http://lists.openstack.org/pipermail/openstack-dev/2016-March/091075.html</a></div>
</div>
</div>
</div>
</blockquote>
</span>
</body>
</html>