[Lvfs-announce] Vendor PSIRT teams
Richard Hughes <[email protected]> Wed, 26 Apr 2023 19:37:19 +0100
| Newsgroups | dev.linux.lists.lvfs-announce,dev.linux.lists.lvfs-general |
|---|---|
| Message-ID | <CAD2FfiHYvNrnSxtVJHJjzmPOAxdKuvxexV3APNb4rYaDE_VB8w@mail.gmail.com> |
Hi all, I've just deployed a new LVFS version that shows if each vendor has a Product Security Incident Response Team (PSIRT) team contact URL. The PSIRT URL is normally a link to a website e.g. https://www.intel.com/content/www/us/en/security/security-practices/vulnerability-management/vulnerability-handling-process.html but it can also be an email address e.g. mailto:[email protected] and tells users where to report security bugs affecting devices from that vendor. In various places, but most publicly in https://fwupd.org/lvfs/vendors/ we show a red cross next to vendors without a PSIRT team defined in the LVFS. If you see a red cross and you *do* have a public security reporting page please let me know and I can update your vendor details. Questions welcome, but please reply to the general list. Thanks. Richard