Re: [gentoo-security] just can't let it die

[Sune Kloppenborg Jeppesen]

I'm short on time so here's a quick answer to your questions.

On Thursday 11 November 2004 09:41, Chris Haumesser wrote:
<snip>
> Is there a written policy for determining what issues warrant the
> issuance of a GLSA?  If so, where?  If not, should there be?

http://security.gentoo.org should provide you with the pointers requested.

> What does the gentoo developer handbook have to say about security?
> Should it address the security expectations we have of software developers?

I would say yes, but noone has done it yet.

> To what extent should the community be involved in managing security
> issues?  What mechanisms exist for this?  Should there be a more
> streamlined way for users to see what the status of current security
> efforts is?

As with most of the development process there is http://bugs.gentoo.org.

But I'm all ears for other proposals, we love contributions.

> Is there a set of criteria we can agree on that might aid us in
> assessing the severity of a threat and need for a fix, in a way that is
> reasonable and fair?  How are potential threats currently assessed?

See Vulnerability Policy on the above page.

> What should someone do if they think a serious problem is being
> overlooked or actively ignored?  Is there a way to set up some
> protocols/procedures that might avoid this kind of flame war in the future?

File a security bug at http://bugs.gentoo.org

>
> I hope no one sees this as trolling.  I'm not trying to start another
> flame war, but I think these are all fundamental, legitimate questions
> raised by this thread.  Where exactly _does_ the gentoo project stand on
> security?  And how do I find out?  This is a key piece of missing
> perspective.
http://www.gentoo.org -> Security Announcements

-- 
Sune Kloppenborg Jeppesen (Jaervosz)
Operational Manager
Gentoo Linux Security Team