[gentoo-commits] gentoo commit in xml/htdocs/security/en: padawans.xml

[Robert Buchholz (rbu)]

rbu         09/04/14 00:59:16

  Modified:             padawans.xml
  Log:
  Add references to oss-security list and wiki, CVE ids and the SVN, plus add mabi.

Revision  Changes    Path
1.70                 xml/htdocs/security/en/padawans.xml

file : http://sources.gentoo.org/viewcvs.py/gentoo/xml/htdocs/security/en/padawans.xml?rev=1.70&view=markup
plain: http://sources.gentoo.org/viewcvs.py/gentoo/xml/htdocs/security/en/padawans.xml?rev=1.70&content-type=text/plain
diff : http://sources.gentoo.org/viewcvs.py/gentoo/xml/htdocs/security/en/padawans.xml?r1=1.69&r2=1.70

Index: padawans.xml
===================================================================
RCS file: /var/cvsroot/gentoo/xml/htdocs/security/en/padawans.xml,v
retrieving revision 1.69
retrieving revision 1.70
diff -u -r1.69 -r1.70
--- padawans.xml	10 Mar 2009 10:52:51 -0000	1.69
+++ padawans.xml	14 Apr 2009 00:59:16 -0000	1.70
@@ -11,6 +11,9 @@
 <author title="Author">
   <mail link="falco@g.o">Raphael Marichez</mail>
 </author>
+<author title="Author">
+  <mail link="rbu@g.o">Robert Buchholz</mail>
+</author>
 
 <abstract>
 This document contains procedures applying to the security team
@@ -21,8 +24,8 @@
 <!-- See http://creativecommons.org/licenses/by-sa/1.0 -->
 <license/>
 
-<version>0.3.7</version>
-<date>2008-10-03</date>
+<version>0.3.8</version>
+<date>2009-04-14</date>
 
 <chapter>
 <title>Security recruits</title>
@@ -33,7 +36,7 @@
 <p>
 The recruitment process for security developers is somewhat different from
 the mainstream recruitment process. Knowledge of Gentoo specifics is not
-as important as it is for other developers, since they won't have commit
+as important as it is for other developers, since they don't need to have commit
 rights to the Portage tree. On the other hand, they must have a good
 security background, good knowledge of written English and must progressively
 be given more responsibility.</p>
@@ -74,18 +77,24 @@
 <ti>Apprentice</ti>
 <ti>rbu</ti>
 </tr>
-<tr>
+<!-- inactive, rbu 2009-04-14<tr>
 <ti>Emanuele Gentili</ti>
 <ti>emgent</ti>
 <ti>Scout</ti>
 <ti>none yet</ti>
-</tr>
+</tr>-->
 <tr>
 <ti>Lars Hartmann</ti>
 <ti>psychoschlumpf</ti>
 <ti>Apprentice</ti>
 <ti>none yet</ti>
 </tr>
+<tr>
+<ti>Matti Bickel</ti>
+<ti>mabi</ti>
+<ti>Apprentice</ti>
+<ti>none yet</ti>
+</tr>
 <!-- inactive (vorlon 2008-07-04)
 <tr>
 <ti>Jule Slootbeek</ti>
@@ -136,7 +145,7 @@
 First step in joining the team is to be a scout. You will have to
 follow major security lists and websites (your choice) and submit bugs
 for things that are not yet in the
-<uri link="http://tinyurl.com/3nyg7">current Security bugs</uri>.
+<uri link="https://bugs.gentoo.org/buglist.cgi?query_format=advanced&amp;short_desc_type=allwordssubstr&amp;short_desc=&amp;product=Gentoo+Security&amp;long_desc_type=allwordssubstr&amp;long_desc=&amp;bug_file_loc_type=allwordssubstr&amp;bug_file_loc=&amp;status_whiteboard_type=allwordssubstr&amp;status_whiteboard=&amp;keywords_type=allwords&amp;keywords=&amp;bug_status=UNCONFIRMED&amp;bug_status=NEW&amp;bug_status=ASSIGNED&amp;bug_status=REOPENED&amp;emailassigned_to1=1&amp;emailtype1=substring&amp;email1=&amp;emailassigned_to2=1&amp;emailreporter2=1&amp;emailcc2=1&amp;emailtype2=substring&amp;email2=&amp;bugidtype=include&amp;bug_id=&amp;votes=&amp;chfieldfrom=&amp;chfieldto=Now&amp;chfieldvalue=&amp;cmdtype=doit&amp;order=Reuse+same+sort+as+last+time&amp;field0-0-0=noop&amp;type0-0-0=noop&amp;value0-0-0=">current Security bugs</uri>.
 Search for duplicates in resolved bugs before submitting! We will assign
 a senior developer as 'Mentor' to you. He will show you around and answer
 all your questions (but don't hesitate to contact any other senior
@@ -151,19 +160,35 @@
 Unfortunately, this only works for bugs you filed. You will be allowed to edit and move
 other bugs around when you are developer on probation.</p>
 <p>Finding security bugs can be very difficult and boring, but try to go through the
-slave labor. You can also try to find other tasks that interest you, for example trying
+slave labor. There are several ways to make your life easier. Some primary channels have
+a rather high signal-to-noise ratio like Full Disclosure, but there are also
+other <uri link="http://oss-security.openwall.org/wiki/mailing-lists">mailing
+lists</uri> like oss-security that are more focussed for distribution vendors.
+You might also be interested in secondary channels, for instance, <uri
+link="https://secunia.com/advisories/">Secunia Advisories</uri> can be
+subscribed to via a mailing list, or <uri
+link="http://www.securityfocus.com/bid">BugTraq BIDs</uri> and <uri
+link="http://cve.mitre.org/">CVE identifiers</uri> can be followed via
+RSS feeds. You can find tools to easily handle newly assigned CVE identifiers, and
+perform other routine tasks in the <uri
+link="http://overlays.gentoo.org/proj/security/timeline">Security SVN</uri>.
+Please consult the README provided there.</p>
+<p>Furthermore, you can also try to find other tasks that interest you, for example trying
 to get in touch with developers that are late with ebuilding and/or stabling or verify
 a vulnerability where it's not sure whether or not Gentoo is affected. You could also try
 to ask your mentor for a task.</p>
-
 <ul>
 <li>You will need: A 
-<uri link="http://bugs.gentoo.org/createaccount.cgi">Gentoo bugzilla
+<uri link="https://bugs.gentoo.org/createaccount.cgi">Gentoo bugzilla
 account</uri></li>
 <li>We will provide you: Nothing</li>
 <li>Estimated time until promotion: between 2 weeks and a month, but depends on your
 personal effort and skills.</li>
 </ul>
+<note>
+Do you know how to look up a bug by CVE identifier in the Bug trackers of the
+other distributions? If not, try to find it out or ask your mentor.
+</note>
 
 </body>
 </section>
@@ -190,6 +215,10 @@
 <li>Estimated time until promotion: until we are confident that you are able to
 draft quality advisories. That should take roughly a month if you are good.</li>
 </ul>
+<note>
+Have you read more than one page on the <uri
+link="http://oss-security.openwall.org/wiki/">oss-security wiki</uri> yet?
+</note>
 
 </body>
 </section>