Re: RFC: creating a security team

[Vincent Untz <vuntz gnome org>]

Hey,

Le vendredi 23 mars 2007, à 13:16, Federico Mena Quintero a écrit :
> El mar, 20-03-2007 a las 20:49 +0100, Vincent Untz escribió:
> 
> > Would it make sense to create a small security team? I guess it wouldn't
> > be a lot of work, since it'd be mainly contacting the relevant
> > maintainers. We would probably create a private security gnome org
> > mailing list. And also, we could add a small checkbox in bugzilla to
> > mention that a bug is security-related, so it should be hidden by
> > default (and the security team would be cc'ed).
> 
> Getting reports on security bugs -> an alias for the release team is
> probably fine; make sure distributor-list gets notified as well.

I'm not sure about using an alias for release team: usually, security
bugs are hidden before there's a fix delivered. That's why I suggested a
private security gnome org mailing list. Members of this list could well
be the release team.

> Someone *may* need to get their act together and patch obsolete GNOME
> releases as well :)

I'd love to understand that this means you're volunteering for this ;-)

> Notifying distributors of security fixes -> do we need anything more
> than to mail distributor-list when a fix is available?  We can ask
> maintainers to mail that list when appropriate.

Again, I'm slightly worried that mailing a public mailing list might not
be perfect if the fix didn't go downstream first.

Vincent

-- 
Les gens heureux ne sont pas pressés.