Re: Final pass on BOF issues for -01

[Florian Weimer <fw@deneb.enyo.de>]

"Budd, Fred" <Fred.Budd@wiltel.com> writes:

> If the language is left in, I'd prefer the following change:
> Vendors MUST provide fixes for e.g. CERT exploits

CERT/CC doesn't publish exploits.

> for all systems supported at the time the exploit is discovered.

Vendors aren't psychic, usually there isn't a fix if a vulnerability
is discovered by external testing.

I'd think it's better to omit this area in the document.  It's still
subject to discussion how security bugs in widely deployd networking
gear should be handled.