Re: Resources for glibc CNA

On 2023-08-10 14:15, Konstantin Ryabitsev wrote:
> On Thu, Aug 10, 2023 at 01:17:02PM -0400, Siddhesh Poyarekar wrote:
>> Hello,
>>
>> I recently proposed setting up a CNA for glibc and it looks like there's
>> general consensus on us doing this.  As part of this set up we would need an
>> email address (preferably one that can accept encrypted submissions from
>> issue reporters) to reach the glibc security team and web pages to publish
>> security advisories.
> 
> I am not familiar with "CNA" in this context, but I assume it's some kind of
> Numbering Authority similar to a CVE?

Sorry, yes, CNA is CVE Numbering Authority.  We're looking to form a 
volunteer group to become a CNA under Red Hat as the root CNA so that we 
can triage incoming reports first hand.

>> I wanted to know if this is something we could/should set up on LF
>> infrastructure or if I should try and get something up on sourceware.
>> Konstantin, does LF already have some infrastructure for this that we can
>> share?
> 
> Yes and no. We do have infrastructure for encrypted communication called
> "remail" where hardware vendors discuss vulnerabilities that are likely to
> affect millions of high-profile devices. For example, it was used for
> collaborating on the patches fixing the recent speculative execution
> vulnerabilities. The setup is described in this document:
> https://korg.docs.kernel.org/remail.html
> 
> However, this may be an overkill for what you need and also introduces
> multiple levels of complexity that you may not want. The alternative is to set
> up a private PGP keypair and share the decryption and signing subkeys among
> members who are duty bound to respond to vulnerability reports.

remail functionality is exactly what I had in mind actually.  What 
complexity would be involved in setting this up?

> For the publication, I usually strongly advise a simple static site that can
> withstand very high traffic. I believe there is general consensus that
> "toolchain.dev" is the domain to be used for CTI purposes, so something could
> be published on advisories.toolchain.dev or similar.

Ack, a static site would be perfect, perhaps with markdown pages and git 
access, similar to our plan for the wiki.

Thanks,
Sid