Am 08.06.2017 um 23:14 schrieb Ola Lundqvist:
> Hi LTS team
>
> Today I got a reply from the tor maintainer that he felt pushed. He
> wanted me to hold back more than a few minutes before pinging him.
> I'm guessing this because the security team informed him shortly before.
> I do not know that for sure yet as I just sent that email.
>
> My question to you is if we should change the instructions at
> https://wiki.debian.org/LTS/Development ?
> The instructions do not give any guidance on this.
[...]
I think we overdo it sometimes with those contact emails. If I recall
correctly then it was Peter himself who asked the security team in
#debian-security to assign the CVE for tor. So he was fully aware of the
fact that there was a security issue.
The wiki really contains only guidelines. Don't follow every sentence by
the book. I suggest to look at the changelog history of a package before
you send a contact email. If members of the LTS team have worked on it
several times before, then there is no need to ping the maintainer
again. We have handled it in the past, so we will handle it again. We
should also make sure that there is a proper bug report before we send
an email because otherwise the maintainer might feel taken by surprise.
Markus