On Thu, 2006-03-09 at 14:02 +0100, Hans de Goede wrote: I do skim the bugtraq and full-disclosure feeds from http://www.djeaux.com/rss/ and report whatever I notice, eg. this a few days ago: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=184097 I am interested, and will probably get more involved in the future once I find new owners for a bunch of packages I'd rather no longer maintain in FE (I have too much on my plate at the moment). BTW, it could be useful to place this link prominently somewhere: https://bugzilla.redhat.com/bugzilla/buglist.cgi?product=Fedora+Extras&am... BTW #2, would it be possible to set Reply-To for this list to the list address?

Jesse Keating wrote: +1 and I guess this means that a couple of my mails have gone awal. Mine isn't and I'm using thunderbird, which is imho a respectable client, thus assuming that clients handle reply-list is a wrong assumption. Regards, Hans

On Thu, 2006-03-09 at 22:14 +0200, Ville Skyttä wrote: I guess it depends on how we use this list. We may want to ping for somebody to help with a given package, but not want to have a public record of the discussion of sensitive matter until such time as updates are prepared. I don't want to see this list become a place for hackers to listen in on what packages are known to be flawed. It took me VERY little time to get used to <ctrl>l to reply list. I am on a LOT of lists and not all are configured the same. Remembering <ctrl>l for every list will always do the right thing wrt replying to the list. There are other RFE matters against munging the reply-to headers, but that's an exercise for the bored. I've voiced my opinion, others can do the same. -- Jesse Keating Release Engineer: Fedora

On Thursday 09 March 2006 14:37, Jesse Keating wrote: We definetly do not want this. a private list is probably needed for such things perhaps becoming public after 30 -60 days kmail you just hit l to reply to list no i just need to make sure i always select the right profile or setup the folder for the list so its done for me :) Dennis

On Thu, 2006-03-09 at 18:33 +0100, Hans de Goede wrote: I haven't really gone through the list yet, but will be posting a summary to the extras list after I do, which will probably be pretty shortly after FC5 is out. Um, is that something else than http://fedoraproject.org/wiki/Extras/SIGs/Security ? ("This page is currently obsolete but the Security SIG will move back here once the structure is finalized.")

On Thursday 09 March 2006 07:02, Hans de Goede wrote: Hey Hans, I have been checking bugtraq, this week i have been sidetracked with some other issues. But im still in. I Just built new snort packages that fix their venerability. Dennis

I'm hoping we can revive this thread. There seems to be marginal interest in a FE security team. I imagine after LWE and FUDCon, there will be a renewed interest, so this may be a fine time to move forward. Since the SIG already exists, I'll let them speak up. If there is no longer a SIG, that's fine too. Is anybody working on any of these things? -- JB

Jesse Keating wrote: There used to be, it consisted of me, Jason L Tibbitts III and Dennis Gilmore. Both me and Jason are currently (also) active in the Games SIG I must say I like the Games SIG much better as there is a lot more getting done there. In the Security Sig it was just all talk, and I'm not a talker but a do-er. I also very much agree that what we need most is some kinda security process we need: -a wiki/Extras/Security page that tells users what todo and expect when they find a security problem. My suggestion: -user should search in bugzilla (by CVE in summary if there is a CVE) Maybe we can create a special form for by CVE searching? -if its not in bugzilla user should submit it there. -this lists gets auto-cc-ed -the maintainer handles it, asking for help (on this list) as needed To make this work / get some real tracking: -if a maintainer finds a bug or pushes a new version with a bug fixed he/she should put this bug in bugzilla and close it immediatly. -a place and an easy way to send FE security announcements last time I brought this up I landed in some xml mumbo jumbo jungle, what wrong with a plain email, with a simple plain text template as base for someone wishing todo an announcement to fill in. Unfortunatly although many maintainers do a great job even on security some don't thus we need: -some kinda rules (FESco action!) when someone can step on a maintainers toes by pushing a fix to CVS and building it because the maintainer is not responding to a security bugzilla entry in a timely fashion. I know that currently anyone can do this if they feel like it, but I for one would like to have a FESco declared policy for this where I can point a maintainer at when he gets pissed (iow I want to be able to hind behind FESco, yes!) What am I willing todo to help? : -lurk on this list -check the new security bugs page of lwn against FE (I have being doing this for the last few weeks) -help people with security problems in C(++) code -audit C(++) code on request (see my scorched3d work f.e.) -audit / check C(++) security patches What am I not willing todo to help? -get involved in policy making / procedure forming -other unneeded bureaucracy (the above is needed!) -talk talk talk, just point me to a broken piece of code please. So in the light of what I like and what I don't like consider this one of my last posts in this thread, but don't mistake this with me being unwilling to help or being uninterested! Regards, Hans p.s. I still don't like the default reply-to setting of this list, but lets not go there.