Re: [gentoo-dev] GLEP #14: security updates based on GLSA

[Marius Mauch]

On Fri, 22 Aug 2003 21:50:15 +0200
Karsten Schulz <kaschu@×××××××××.de> wrote:

> Am Freitag, 22. August 2003 19:19 schrieb Marius Mauch:
> > Everything in the GLEP is open for discussion, please share your
> > questions/comments/concerns with the other people on this list
>
> just a few suggestions from me:
> I would remove the 'severity' attribute from the dtd. It depends on
> your local configuration wether a software bug is critical for your
> systems or not. Btw. who will explain the difference between 'high'
> and 'critical'. On my systems 'high' *is* 'critical'.
> A GLSA is per se important and needs attention, imho there is no need
> to differentiate it further, and every admin has to decide for himself
> respectively.

Well, I've taken that from the existing GLSA format, it is currently not
used by my code. I've no real opinion on that, someone from the security
team (aliz, solar ?) should decide that.

> For admin's convinience, I would like to have an optional URL element,
> which can contain a location, where the bug is discussed (in addition
> to the CVE, which is not available in every case). The URL could point
> to the mailinglist of the program developers or other serious sources
> like security lists. This would just help the admin to get more
> information about the bug.

Might be useful, any objections to include that information?

> I would like to second Calebs suggestion to sign GLSAs. Besides there
> is need for a central Security page at www.gentoo.org, where users and
> admins get some hints how the security related communication works
> (Who creates and checks GLSAs, which public keys are used, a.s.o.)

Well, I think that's outside of the scope of this GLEP.

> My last point: The last few weeks, there were no new GLSAs, but some
> security related discussions elsewhere (unzip, gdm, XDMCP and others).
> There were no statements or GLSAs from Gentoo about such stories. It
> would be nice to have some kind of feedback, that the security team is
> aware of current problems. I would like to see GLSAs in a regular
> schedule, with status reports, which exploits, bugs and incidents are
> currently under examination. Imho GLSAs must not provide bugfixes in
> every case, they can provide only information, too. So the element
> 'fixed' in the dtd should allow the value 'none', when it is
> important, that Gentoo users get security related information without
> providing a solution in form of a software update.

I don't like the idea of GLSAs being used for that, a simple status
update email on gentoo-security should do the job (again, that's
outside the scope of this GLEP). 
The DTD does not require the <fixed> tag to contain a <version> tag, so
the special value none is not necessary.

Marius

--
gentoo-dev@g.o mailing list