Re: the Gentoo Audit project and dev-util/splint

Hello Mansour,

On Wednesday 10 June 2009, Mansour Moufid wrote:
> > But keep in mind there is a certain amount of work that comes with
> > this.
>
> How much time would members typically put in, say, per week? I
> imagine it's difficult to estimate an 'average' -- since most of the
> time spent is probably in actually reviewing source code -- but I'm
> looking forward to contributing a decent number of hours a week as
> part of this project. Effort is certainly no deterrent.

As with most oss projects, you put in the amount of time you are 
comfortable with. There's usually more items on the TODO stack than you 
can handle anyway, so you either let it rest for a few days/weeks when 
you are busy, or work off large chunks when you have some time to burn.

To get you started, I would suggest you look for tasks that sound 
interesting. There are several bugs that need attention. Some of them 
are in the "Gentoo Security/Audit" section of Bugzilla. Mondo-rescue's 
latest version needs to be looked at, for example: 
https://bugs.gentoo.org/show_bug.cgi?id=106497

There is a list of packages bundling libraries. Some of these might have 
security impact: 
https://bugs.gentoo.org/showdependencytree.cgi?id=251464

There's also some of the "Gentoo Security/Vulnerabilities" bugs that 
need attention. If you're seeking to discover new vulnerabilities 
instead of working on details of existing bugs, can literally start 
anywhere you like.

Contact us in IRC or via Jabber if you need assistance.

Robert

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.11 (GNU/Linux)

iQIcBAABCAAGBQJKMRECAAoJECaaHo/OfoM5Q6sP/jv8nYRdB77Dy2SGndoOXUdA
h31cZUz1txD/QWQI6ao9yg6SIBAK/NH3y8ZYR9Wnpe6wkNdXutheKw6lPxhVLAUU
5TkDwI4E+bDxkhiqMxBD0efBP5efvL9bkYvGnFUUYXWKW9AvqHwIBrLKTYGw+3rG
jZNaCMvPOkb6zpn2HIwKWXJEhp1DSqucAf7BNcCj1Me2APufO9Zv4bZgYPJ87sxL
QKnyMSHC3DmMjqaj5JLGgjO/lIfQDiKZb0TvyV8rCgqqQGWvn1ZyPU5vD8SrewNn
F/yz/khrU6twW89U75lAc1w66Uy13vkDHe7yKdoVEW/+grsW4GvFTDJcf1EN57tS
Xs1RpAvVnBwGlULFP6RZ8XayQo4NCKc711t3QoCpsum/D4H69Kj0Wbb6z+7ph3Gu
qESPdt8hJ0x9OLrhuY9xj16duDty+Xn1JUgxYgdQWwJhls/pwfRVrCXNVgYHwRzf
Hbp0x9tI7iNYvidZs2UZMXSrRGR474BL/WfrVn09HK0a0ZJ9Ir7QPCKlHEwcvJqG
A1WQ/2viMZJe61QxF23b2L1YfeJl98vif9r1V0bcweujvssSBq+8BS0wp3WUcN1b
HytPZP/1X7HyC3EPB5PN467dK4l2gODP0mJSFZHqdakb7hh6ZJwyxqAl2k8vlVuG
RIu4z6G8ZWgI6jDO7PrA
=CRzl
-----END PGP SIGNATURE-----