Re: Re-working group security

Hey Hey :)

Max Kanat-Alexander wrote:
>     The "hackers" group is itself now pretty much obsolete--there is a 
> "developers" group that is inherited by anybody in any product-specific 
> "developers" group.
> 
>     I'd like to propose that we delete the "hackers" group, and any bugs 
> currently assigned to it be re-assigned to the product-specific 
> "developers" group for the product the bug is in, which is a more 
> appropriate handling for security issues anyhow. (There are only 29 bugs 
> that we'd have to move.)
> 
>     That sound OK?
> 
Hm. I'm not really convinced that this is a good idea, but that might be 
due to my limited knowledge about Bugzilla. The usecase I have in mind 
is, that I (as a bugmaster) might want to set a bugreport to a somewhat 
more confidential level, although I am not a developer of that product. 
Will that be still possible?

>     After that, we may want to discuss how to adapt Bugzilla to be more 
> appropriate for storing security and tracking issues for GNOME.
*yay*
> I talked to Owen a bit about this, and he mentioned that currently security 
> issues are reported by sending an email to [email protected],
Oh, didn't know that. We should increase its visibility. Who's 
subscribed there? Are there any published policies (like 
http://www.kde.org/info/security/policy.php)?
I'd be glad to help out building a security-researcher friendly 
infrastructure, but we should probably discuss that on a channel with 
more bandwidth.
> Perhaps we should just auto-CC 
> "[email protected]" on any bug filed with a restriction to a security 
> group, and make it easier to file security bugs with an improved UI for it.
>
Sounds really good.

Thanks for all your work!
   Tobi

_______________________________________________
Gnome-bugsquad mailing list
[email protected]
http://mail.gnome.org/mailman/listinfo/gnome-bugsquad

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkqKrcsACgkQPuBX/6ogjZ5PEwCgrUVn1MC4cVZFkOIGJDDj5ccX
hSYAn10ycrZaqGRG9srp1lBvUnTD60sx
=wsD4
-----END PGP SIGNATURE-----