oss-sec mailing list archives
Re: Fwd: Node.js security update for all active release lines
From: Solar Designer <solar () openwall com>
Date: Wed, 3 Apr 2024 21:42:14 +0200
On Wed, Apr 03, 2024 at 02:01:11PM -0400, Michael Dawson wrote:
Sorry I don't remember the context as to why we agreed to send this forward in the first place.
As I can find, these just started arriving in July 2021. And that was appreciated. Now I merely suggested how to do it a bit better.
As opposed to expanding any work that's a one off for the community security stewards, since it sounds like it may not be meeting your needs, I'd propose that we just remove it from our security release steps and you can subscribe to the nodejs-sec mailing list like everybody else. From that you could generate some automation to pull down the content from the original post.
That's not the outcome I wanted, especially not knowing who would setup and maintain said automation. We do have an outstanding task to create some tools for this sort of automation, but no one approached it yet and it's meant to help prepare drafts for manual posting, so there would be some per-message work anyway. So please continue these postings as-is for now, and we'll hopefully be adding follow-ups with the actual content like I did. You could also want to start including the Markdown files in nodejs-sec postings, so simply forwarding them in here would do what's desired, but that's your call indeed. BTW, the previous update (for February) somehow wasn't sent in here. Per my off-list suggestion, an oss-security contributor later sent a detailed report: https://www.openwall.com/lists/oss-security/2024/03/11/1 but we're not sure we'll do it each time. Thanks, Alexander
Current thread:
- Fwd: Node.js security update for all active release lines Rafael Gonzaga (Apr 02)
- <Possible follow-ups>
- Fwd: Node.js security update for all active release lines midawson (Apr 03)
- Re: Fwd: Node.js security update for all active release lines Solar Designer (Apr 03)
- Re: Fwd: Node.js security update for all active release lines Michael Dawson (Apr 03)
- Re: Fwd: Node.js security update for all active release lines Solar Designer (Apr 03)
- Re: Fwd: Node.js security update for all active release lines Michael Dawson (Apr 03)
- Re: Fwd: Node.js security update for all active release lines Solar Designer (Apr 03)