Re: semi-public issues on (linux-)distros

[Johannes Segitz <jsegitz () suse de>]

Hi,

first of all let me take the opportunity to thank you for your work in this
area. I'm not a member of the distros list anymore (have been for years),
but I appreciate very much what you do for the community.

On Wed, May 03, 2023 at 09:00:11PM +0200, Solar Designer wrote:
> curl project's handling of security issues has been exemplary so far, in

I agree. And I'm happy to see that this is being discussed, as I've seen
Daniel talking on Mastodon about this and it would be a shame if they
wouldn't provide their high quality reports to distributions up front
anymore.

> my opinion at least, which gives me reason to expect sound judgement
> from Daniel on which issues to handle in which way.  Also, like it or
> not, starting to publicly commit some security fixes is a decision the
> project has already made, so our only options are (1) to change the list
> policy, (2) to grant one-time exceptions every time, or (3) to create
> extra work for Daniel for notifying the individual distros other than
> via the list (or choose not to).

My vote is for option 1. 

> I would also be happy to have a general solution if we _reasonably_ can,
> for all projects, but I'm not sure how reasonable that is.  The terms
> for Linux kernel's vs. curl's exceptions may reasonably vary to meet
> these project's exact needs and not more: for Linux kernel it's "issues
> concurrently or very recently handled by the Linux kernel security team"
> and for curl it can be "low and medium severity issues".

This is indeed tricky. I would not try to sync this to specific conditions
of the upstream policy, but to the proven track record of an upstream
project. If they can show that they can reliable do this for security
issues below a certain threshold they should get approved to post
semi-public issues onto the list.

And yes, this isn't a hard criterion that can be easily judged, which is
indeed a problem. There could be some form of vote on the list to decide
this for each project asking for it. In my experience the subscribers are
reasonable and I would expect that this would lead to good results.

Johannes
-- 
GPG Key                EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint:    250F 43F5 F7CE 6F1E 9C59  4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nürnberg, Germany
Geschäftsführer: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
(HRB 36809, AG Nürnberg)

Attachment: signature.asc
Description: Digital signature