Re: [gentoo-project] RFC: Making GLSAs useful for security

[Kent Fredric]

On Sat, 17 Dec 2016 01:13:55 +0000
"M. J. Everitt" <m.j.everitt@×××.org> wrote:

> Picking a rather random post to chip in on, but here we go with my
> thoughts...
>
> How about once we identify a [triaged] security issue, it gets assigned
> a GLSA there and then, and a templated email gets sent out to notify
> users of the vulnerability and the priority assigned to it internally.
> You could also tag a bugzilla reference, for users to track progress in
> between identification and resolution. Then, you should be able to meet
> your published policy by pushing out some information to users, and
> especially sysadmins, so they are informed, and can choose for
> themselves what actions they feel appropriate to take in the first
> instance (eg. mitigation until resolution is found).
>
> Then, post a 'FIXED' message referencing again the GLSA and bug ref. to
> indicate the 'preferred' resolution, any appropriate package updates,
> etc. once this has been tested/stabilised/etc. to allow for manpower
> issues and anything else that could be considered 'beyond reasonable
> control' from the Gentoo angle. Yes, so you get double the "spam", but
> since security issues are relatively infrequent (vs. -dev bikeshedding,
> etc) I don't honestly think that the burden of early vs. late
> notification against extra email messages to be kept informed would be a
> problem for most people appropriately concerned.

Or you could have different streams for different grades of GLSA ( ie:
weak advisory ones that aren't qualified with exploits, vs ones that
are detailed strong avisories where people know the full extent of the issue)

That way you, in following with gentoo principles, allow the user to decide
what they care about the most and opt in to which of these they receive.