| 1 |
On Wed, Jul 6, 2016 at 10:02 AM, Kristian Fiskerstrand <k_f@g.o> wrote: |
| 2 |
> On 07/06/2016 03:49 PM, Rich Freeman wrote: |
| 3 |
> |
| 4 |
>> I understand that. However, I just sometimes wonder whether that |
| 5 |
>> approach makes sense. The result of the current system is that we |
| 6 |
>> don't release GLSAs until well after a bug is fixed, sometimes after |
| 7 |
>> months. |
| 8 |
> |
| 9 |
> It makes sense for long term server management where you don't want to |
| 10 |
> update the full tree too often, but I agree GLSAs needs to be put out |
| 11 |
> more timely |
| 12 |
> |
| 13 |
|
| 14 |
Another way to do it is to have a system like this: |
| 15 |
1. Vulnerability is logged into database. |
| 16 |
2. After embargo period (if any), entry is published. Tools |
| 17 |
available to the user make them aware they have a vulnerable package |
| 18 |
installed and the realtime status of whether a fix is available. |
| 19 |
3. Once a package is stable, the tools let the user auto-update the package. |
| 20 |
4. Once all archs are cleaned up, publish the GLSA by email as usual. |
| 21 |
|
| 22 |
So, this is like the current state, except tools like glsa-check use a |
| 23 |
realtime-updated database (or at least one as up-to-date as the latest |
| 24 |
sync) and not a database that is only updated after the last arch is |
| 25 |
stable. We don't need to send users 14 emails as archs are |
| 26 |
stabilized. But, the tools they likely would want to use do use the |
| 27 |
latest info. |
| 28 |
|
| 29 |
Sure, in the early days it would just tell them they're vulnerable |
| 30 |
with no suggested fix, since we don't have a fix yet. But, that is |
| 31 |
still information the user can use to their advantage. |
| 32 |
|
| 33 |
Ideally the early phases of this would be tied into bugzilla so that |
| 34 |
somebody isn't manually updating GLSA xml files every time something |
| 35 |
changes. |
| 36 |
|
| 37 |
-- |
| 38 |
Rich |
Archives