Re: Fwd: Node.js security update for all active release lines

[Michael Dawson <midawson () redhat com>]

The reason we post the link in the nodejs-sec posts is to reduce the work
for the security stewards and avoid problems with cut/paste. Markdown does
not paste into gmail and work is required to reformat etc.

I can understand that you'd prefer that we do more work so that your
organization can do less work but at this point that is not something I'd
support. We don't do any extra steps for any other organization and
explaining why a forward is needed versus somebody from openwall
subscribing to the mailing list is something I already don't know how to
explain.

I'm not going to rush to remove what we have been doing from the
security release process, but trying to explain why I don't think asking
for more makes sense.  You can always open an issue in the nodejs/node repo
to discussion/make a case if you think it make sense.

On Wed, Apr 3, 2024 at 3:42 PM Solar Designer <solar () openwall com> wrote:

> On Wed, Apr 03, 2024 at 02:01:11PM -0400, Michael Dawson wrote:
> > Sorry I don't remember the context as to why we agreed to send this
> forward
> > in the first place.
>
> As I can find, these just started arriving in July 2021.  And that was
> appreciated.  Now I merely suggested how to do it a bit better.
>
> > As opposed to expanding any work that's a one off for the community
> > security stewards, since it sounds like it may not be meeting your needs,
> > I'd propose that we just remove it from our security release steps and
> you
> > can subscribe to the nodejs-sec mailing list like everybody else. From
> that
> > you could generate some automation to pull down the content from the
> > original post.
>
> That's not the outcome I wanted, especially not knowing who would setup
> and maintain said automation.  We do have an outstanding task to create
> some tools for this sort of automation, but no one approached it yet and
> it's meant to help prepare drafts for manual posting, so there would be
> some per-message work anyway.
>
> So please continue these postings as-is for now, and we'll hopefully be
> adding follow-ups with the actual content like I did.  You could also
> want to start including the Markdown files in nodejs-sec postings, so
> simply forwarding them in here would do what's desired, but that's your
> call indeed.
>
> BTW, the previous update (for February) somehow wasn't sent in here.
> Per my off-list suggestion, an oss-security contributor later sent a
> detailed report:
>
> https://www.openwall.com/lists/oss-security/2024/03/11/1
>
> but we're not sure we'll do it each time.
>
> Thanks,
>
> Alexander