Re: CERT Vendor-Initiated Bulletin VB-98.04 - xterm.Xaw

[perry () piermont com (Perry E. Metzger)]

Theo de Raadt writes:
> What is this.  Is The Open Group now selling security patches only to
> their members?
>
> I asked the XFree86 people.  They have received no communication from TOG
> about this at all.  I think this is extremely bad ethics on the part of
> TOG to publish information on a security problem and then only give fixes
> to people who have given them money.

For once, I agree completely with Theo. It was bad enough that TOG
decided to turn X into proprietary software -- saying that security
patches for back revs are proprietary is nearly unacceptable behavior.

Perry