> Oops, it looks like I got the address wrong. I didn't intend to mail > the public debian-security@d.o list but rather the private security > team list. Too late now. For future reference we do see vendor-sec mails, so the second copy wasn't really necessary. (Although it is helpful to make sure we get mails if it looks like there is no visible progress.) I hope that doesn't make you feel any worse! Steve --