oss-sec mailing list archives
Re: Fwd: Node.js security update for all active release lines
From: Michael Dawson <midawson () redhat com>
Date: Wed, 3 Apr 2024 15:51:28 -0400
The reason we post the link in the nodejs-sec posts is to reduce the work for the security stewards and avoid problems with cut/paste. Markdown does not paste into gmail and work is required to reformat etc. I can understand that you'd prefer that we do more work so that your organization can do less work but at this point that is not something I'd support. We don't do any extra steps for any other organization and explaining why a forward is needed versus somebody from openwall subscribing to the mailing list is something I already don't know how to explain. I'm not going to rush to remove what we have been doing from the security release process, but trying to explain why I don't think asking for more makes sense. You can always open an issue in the nodejs/node repo to discussion/make a case if you think it make sense. On Wed, Apr 3, 2024 at 3:42 PM Solar Designer <solar () openwall com> wrote:
On Wed, Apr 03, 2024 at 02:01:11PM -0400, Michael Dawson wrote:Sorry I don't remember the context as to why we agreed to send thisforwardin the first place.As I can find, these just started arriving in July 2021. And that was appreciated. Now I merely suggested how to do it a bit better.As opposed to expanding any work that's a one off for the community security stewards, since it sounds like it may not be meeting your needs, I'd propose that we just remove it from our security release steps andyoucan subscribe to the nodejs-sec mailing list like everybody else. Fromthatyou could generate some automation to pull down the content from the original post.That's not the outcome I wanted, especially not knowing who would setup and maintain said automation. We do have an outstanding task to create some tools for this sort of automation, but no one approached it yet and it's meant to help prepare drafts for manual posting, so there would be some per-message work anyway. So please continue these postings as-is for now, and we'll hopefully be adding follow-ups with the actual content like I did. You could also want to start including the Markdown files in nodejs-sec postings, so simply forwarding them in here would do what's desired, but that's your call indeed. BTW, the previous update (for February) somehow wasn't sent in here. Per my off-list suggestion, an oss-security contributor later sent a detailed report: https://www.openwall.com/lists/oss-security/2024/03/11/1 but we're not sure we'll do it each time. Thanks, Alexander
Current thread:
- Fwd: Node.js security update for all active release lines Rafael Gonzaga (Apr 02)
- <Possible follow-ups>
- Fwd: Node.js security update for all active release lines midawson (Apr 03)
- Re: Fwd: Node.js security update for all active release lines Solar Designer (Apr 03)
- Re: Fwd: Node.js security update for all active release lines Michael Dawson (Apr 03)
- Re: Fwd: Node.js security update for all active release lines Solar Designer (Apr 03)
- Re: Fwd: Node.js security update for all active release lines Michael Dawson (Apr 03)
- Re: Fwd: Node.js security update for all active release lines Solar Designer (Apr 03)