Re: cvs: temporary file handling fixes

Hi Alexander,

You write:
> In particular, I was looking for a (security) bug reporting address
> that wouldn't automatically reach a public mailing list, -- but it
> seems you find unsafe temporary file handling to be a minor enough
> issue to be discussed in public.  This is OK with me, but I thought
> that some vendor-sec members could prefer to handle it differently.

I do not know anyone on the development team that believes that cvs is a
'secure' program today. It should be improved, but it was not designed
with security in mind and is often too trusting of the data is has on
hand.

I personally would find it desirable to remove as many of the 'known'
security holes as possible in cvs. For now, this means that you need to
air them on the [email protected] list.

If you feel that you have found something that is particularly evil that
should not be aired in public, you could consider sending e-mail to the
project members who have a "Developer" role. In theory, any of us could
apply and or vet an emergency patch to the master cvs repository sources.
You can take the User entry from the "Members" page and add @cvshome.org
if you need to get e-mail to any of us.

Of course, only Derek can release a new version of cvs to the public...

	Thanks,
	-- Mark