Well known vulnerabilities (was RE: Final pass on BOF issues for-01)

[George Jones <gmj@pobox.com>]

> If the language is left in, I'd prefer the following change:
> Vendors MUST provide fixes for e.g. CERT exploits for all systems
> supported at the time the exploit is discovered. Vendors MUST NOT
                                    ^^^^^^^^^^^^^

Discovered by whom ?

How about "becomes well known" per the definition of well known later
in the requirement.

BTW, even though this reqs is slated (for now) to be move from the
BCP doc to the info doc, I think it's worth discussing and documenting
the issues to assist in later debates.  Going into the info/non-BCP
doc will also give more freedom to capture some of the issues/ideas
that would be questionable for a BCP (e.g. things that touch on
financial, contractual issues).

Thanks,
---George