On Sep 4, 2006, at 5:42 PM, Brian McEwen wrote:

> -Why has no-one yet said "no, there isn't a separate mailing list,  
> set of decision makers, etc (I have lost track-- what else? there  
> has been a bit that should be definitively true, or false- and we  
> are techie enough here that "anonymous" disclosure of evidence of  
> things "hidden" that should in fact be known isn't ridiculously  
> difficult).

There's a seperate mailing list.  It's an internal list.  It's where  
some developers discuss technical things that they're afraid to bring  
up on the public lists because they will find themselves spending all  
their time fending off the likes of Greg Woods who will argue about  
any technical proposal, just for the sake of arguing... Developers  
are constantly reminded to stop having technical discussions on the  
internal list and to take them public.  So most developers choose to  
stop discussing out in public and either just stop bothering or  
simply do the work in silence.  Incidentally, I'm part of another  
open source community and the same problems occur there as well.   
There are always a few members of the community who feel they have to  
criticize every little piece of everything to increase their google  
vanity rating.

Also, there are internal lists where security issues are raised and  
dealt with before disclosure date.  While I'm sure everyone wants to  
see this stuff publicized at 0-day, I believe there's a precedence  
set that this sort of thing is not disclosed publicly until all of  
the other vendors have had their chance as well.  I've always  
believed this is part of what the 'developers agreement' was intended  
to address...

Of course, getting back to paragraph 1, I'm afraid to even post on  
public lists and I'm quite certain I know this response will have  
been a dreadful mistake.

Feel free not to Cc me on any subsequent discussions.