Re: Flatcar membership on the linux-distros list

[Solar Designer <solar () openwall com>]

On Thu, Jul 23, 2020 at 02:06:14PM -0400, Vincent Batts wrote:
> On Mon, Jul 20, 2020 at 2:36 PM Solar Designer <solar () openwall com> wrote:
> > Vincent, as far as I could find, you personally have subscribed to
> > oss-security 2 months ago, and I couldn't find anyone else from Flatcar
> > Linux subscribed.  (Maybe people are with personal addresses that I
> > didn't associate with Flatcar Linux.)
>
> For sure.
> While I personally have been near the core of a couple of distributions, I
> never was involved in the contributing-side with oss-security or vendor-sec.
> 2 months ago I joined the Kinvolk team, and now squarely involved in this
> aspect.
> As for security disclosure overlap, there will now be a decent overlap with
> an operating system component being containers. As I facilitate and lead
> the Open Containers Initiative (OCI) security list, which hosts code like
> runc, specifications and API definitions for container registries.
> https://github.com/opencontainers/.github/blob/master/SECURITY.md

Quite some overlap with (linux-)distros in the approach you use to
pre-public-disclosure handling of security issues, indeed.  One notable
difference is you don't appear to have a maximum embargo time.

> Alban Crequy (CC'ed) who is on the team has had interactions (which
> pre-date flatcar):
> https://seclists.org/oss-sec/2015/q2/722
> https://seclists.org/oss-sec/2014/q3/4

Oh, as I understand from your e-mail signature, Alban is one of your
company's directors.  If so, I do find it convincing for Flatcar Linux's
membership that one of your directors has personally contributed to
security vulnerability discovery and handling.

> Otherwise, the majority of contributions are involved in the respective
> upstreams of the projects.

Such contributions are relevant, too.

> > As I recall other applications to join the linux-distros list since we
> > introduced this contribute-back requirement, distros volunteered for
> > some tasks right away, not "after being a member for a period."  What
> > you say makes sense, but would be a deviation from the practice so far.
> > I'd appreciate not needing to make an exception for you.
>
> Yeah, no worries! We can begin immediately with:
> * Check if related issues exist in implementations of similar functionality
> in other software

Great.  Ubuntu already signed up as primary for this task, so Flatcar
can be backup.

> * Promptly review new issue reports for meeting the list's requirements and
> confirm receipt of the report and, when necessary, inform the reporter of
> any issues with their report

This one already has both a primary and a backup.  So unless you choose
another second task for you (that doesn't already have two distros
signed up for it), you'll initially be just a backup for "Check if
related issues exist in ... other software", which is fine.

> The number of packages in distro is drastically reduced, and we'll be on
> this.

I don't understand this comment and its relevance, but nevermind.

> > > Pat Volkerding can vouch for me (CC???ed), and maybe others, but I asked
> > > volkerdi first :-)
> >
> > We haven't yet heard from Pat Volkerding.  Given your LinkedIn profile,
> > I guess someone from Red Hat could vouch for you as well.
>
> Pat operates at his time. :-)
> I was not heavily involved on this team at RH, but am asking there and a
> few others as well.

OK.  It looks like we'll add Flatcar as soon as an existing member
vouches for you.

Alexander