Re: [gentoo-security] For folks interested in helping with gentoo security efforts

[Joshua J. Berry]

On Thu, Mar 18, 2004 at 09:17:59AM -0500, Kurt Lieber wrote:
> All --
>
> Based on recent threads, I thought I'd articulate some of the areas where
> the gentoo security team needs assistance.  These are listed in order of
> priority, but all of the positions are very important to our efforts to
> have a cohesive security team.

I go to college fulltime, but I do have some breaks here and there where
I might be able to help out.

>
> 1) Security bug wranglers -- we need folks to watch Bugzilla for new
>    security bugs.  When new bugs come in, they need to validate them, work
>    with the dev team to get things patched and (at the same time) work on
>    writing up the GLSA so it's ready for publication at the same time the
>    patched ebuilds are.

I can help with this, once I learn your processes.  I'm familiar with
both C and Bugzilla, although I don't know how much time I'll have to
spend on actually writing code to validate/test exploits.  I think I
would be best here at handling random administrative kinds of things;
for instance, taking an already-validated exploit and writing a GLSA for
it, or incorporating an already-made patch into an ebuild.

> 2) Documentation writers -- we *really* need 1 or 2 good documentation
>    writers.  Folks who know or can learn GuideXSL (if you know HTML, you
>    can learn GuideXSL) and can help put our policies and procedures to
>    paper so they can be published on the security page.  A lot of the work
>    here will be talking to a bunch of different folks to understand how
>    things work currently and then compiling that in a form that is easy to
>    understand for external users.

I am fairly good at writing documentation, and I can pick up GuideXSL
along the way.  Again, this is just a question of how much time I'll
have to spend on this. :)

At the very least, I would be happy to edit what others write.
Hopefully I will have time to actually write stuff, but that depends on
my schedule next quarter.

Next week is my spring break, so if you want my help, I will have plenty
of time then to get up to speed.

-- Josh (CondorDes on IRC)

-----------------------------------------
Joshua J. Berry

"I haven't lost my mind -- it's backed up on tape somewhere."
    -- /usr/games/fortune

NOTE: Please do not submit this email address to any mailing
lists or websites without prior permission.  Thank you.