Re: DragonFly Security Officer and Security Team
It is not just about picking committers with free time and better
understanding of code. The people elected should have more than
adequate knowledge of security concepts.
To conclude, all I am saying is that such a team is not necessary right
now; but... when we do plan on creating such a team, I would rather put
people with proven track record in security related things and just
anyone. I do not mean to offend anyone's attempt at contribution or
giving their time.
Kind regards,
Hiten Pandya
Devon H. O'Dell wrote:
> Hello all,
>
> ``Who can act as a security officer and participate in a security team
> for our project?''
>
> This is a question that I've discussed before with the members of
> #DragonFlyBSD when I joined the project. At the time, it seemed to be
> considered a bit of an unnecessary position. I think as our project
> grows, we will need to formalize this matter a bit. There are good,
> specific reasons to organize a team and a head for this matter; it makes
> inter-project communication regarding security vulnerabilities easier
> and safer.
>
> Unfortunately, obscurity is critical when a vulnerability is discovered.
> As it stands, it is difficult to find anybody to contact privately when
> such a matter is revealed. It may or may not be obvious to some who the
> head developers of the project are and it may or may not be obvious
> whether or not they have time to deal with the issue.
>
> I think formalization of this issue is in order. I certainly have time
> to work in a team and I can probably even allocate enough to act as an
> officer, but I'm not a committer and have contributed relatively little
> to the project code-wise (the lockf(2) patch being virtually everything,
> disregarding installer work and giving my 2 cents on every subject
> that's discussed on IRC), so I'm not sure that I am the most qualified
> person for either of these positions.
>
> I'm certainly up for serving as either (officer / team member) and
> failing either would certainly work to coordinate the gathering of a
> team which is qualified for such a position.
>
> I hope we can get something worked out with this.
>
> Kind regards,
>
> Devon H. O'Dell
討論串 (同標題文章)
完整討論串 (本文為第 8 之 12 篇)：