Re: Suggestion: security fix area

Hi Alberto,

On 6/24/11 1:40 PM, Alberto Lopes wrote:
> Dear John,
>
> That's excellent. I'd like to add a few more suggestions:
>
> 1 - In this days of higher hacker activities, I'd put a link on the
> sitemap (blue footer) or on the "Get Plone" box (right column portlet on
> the first page). It should make it easier for people to find that info.


If we use drupal.org as a "competitor example", this seems like a 
reasonable request. Please open a Website component ticket at 
dev.plone.org/plone.


>
> 2 - In the advisories page, there could be a "table view" for the
> advisories, pointing which Plone version is affected by each
> vulnerability and/or which vulnerability or which hotfix is related to
> each version. The use case is a administrator that goes to the Plone
> site, and needs to know if their Plone site (considering Plone version)
> has up-to-date security or if it is outdated. This "query" should be
> easier than it is now.


Ditto, probably best to request this in a ticket.


>
> 3 - I dunno if this list is the best one to talk about that, but some of
> the sites attacked the last few weeks are powered by Plone. There should
> be an "official" statement about whether the attacks have something to
> do with Plone or not.


Probably not the right place to ask this. I would try board-z4DKO/[email protected] 
and/or security-z4DKO/[email protected]


FWIW, I don't know that any recent publicized hacks (e.g. CIA) have had 
anything to do w/Plone. So the only statement I'd expect is "no comment" 
and/or "there is nothing to comment on".


Further, I think Plone's security track record speaks for itself. And 
all of these recent fixes just shows someone is paying attention (which 
is arguably better than us waiting for hacks to be discovered in the 
wild). We have a huge code base, but:

a. It's Python-based, and inherently safer than any PHP alternative.
b. Our security team is performing regular audits, and acting 
appropriately based on the results of the audits.



Alex





>
> Regards,
>
> Alberto
>
> On Fri, Jun 24, 2011 at 11:39 AM, Jon Stahl <[email protected]
> <mailto:[email protected]>> wrote:
>
>     There already is:
>     http://plone.org/products/plone/security
>
>     :jon
>
>     On Fri, Jun 24, 2011 at 7:35 AM, Alberto Lopes
>     <[email protected]
>     <mailto:[email protected]>> wrote:
>      > Dear friends,
>      > Considering that we had several security fixes the last few months, I
>      > suggest an area to be created on plone.org <http://plone.org> to
>     consolidate all of the
>      > security related information on Plone.
>      > Regards,
>      > Alberto
>      >
>     ------------------------------------------------------------------------------
>      > All the data continuously generated in your IT infrastructure
>     contains a
>      > definitive record of customers, application performance, security
>      > threats, fraudulent activity and more. Splunk takes this data and
>     makes
>      > sense of it. Business sense. IT sense. Common sense..
>      > http://p.sf.net/sfu/splunk-d2d-c1
>      > _______________________________________________
>      > Plone-website mailing list
>      > [email protected]
>     <mailto:[email protected]>
>      > https://lists.sourceforge.net/lists/listinfo/plone-website
>      > The Wiki: http://plone.org/development/current/projects/WebsiteTeam
>      >
>
>
>
>
> ------------------------------------------------------------------------------
> All the data continuously generated in your IT infrastructure contains a
> definitive record of customers, application performance, security
> threats, fraudulent activity and more. Splunk takes this data and makes
> sense of it. Business sense. IT sense. Common sense..
> http://p.sf.net/sfu/splunk-d2d-c1
>
>
>
> _______________________________________________
> Plone-website mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/plone-website
> The Wiki: http://plone.org/development/current/projects/WebsiteTeam


-- 
Alex Clark · http://aclark.net


------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security 
threats, fraudulent activity, and more. Splunk takes this data and makes 
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2d-c2
_______________________________________________
Plone-website mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/plone-website
The Wiki: http://plone.org/development/current/projects/WebsiteTeam