Re: Fwd: Node.js security update for all active release lines

[Solar Designer <solar () openwall com>]

On Wed, Apr 03, 2024 at 02:01:11PM -0400, Michael Dawson wrote:
> Sorry I don't remember the context as to why we agreed to send this forward
> in the first place.

As I can find, these just started arriving in July 2021.  And that was
appreciated.  Now I merely suggested how to do it a bit better.

> As opposed to expanding any work that's a one off for the community
> security stewards, since it sounds like it may not be meeting your needs,
> I'd propose that we just remove it from our security release steps and you
> can subscribe to the nodejs-sec mailing list like everybody else. From that
> you could generate some automation to pull down the content from the
> original post.

That's not the outcome I wanted, especially not knowing who would setup
and maintain said automation.  We do have an outstanding task to create
some tools for this sort of automation, but no one approached it yet and
it's meant to help prepare drafts for manual posting, so there would be
some per-message work anyway.

So please continue these postings as-is for now, and we'll hopefully be
adding follow-ups with the actual content like I did.  You could also
want to start including the Markdown files in nodejs-sec postings, so
simply forwarding them in here would do what's desired, but that's your
call indeed.

BTW, the previous update (for February) somehow wasn't sent in here.
Per my off-list suggestion, an oss-security contributor later sent a
detailed report:

https://www.openwall.com/lists/oss-security/2024/03/11/1

but we're not sure we'll do it each time.

Thanks,

Alexander