On Thu, Jan 30, 2020 at 3:59 PM Robbie Harwood <rharwood(a)redhat.com> wrote:
Richard Shaw <hobbes1069(a)gmail.com> writes:
> Not replying to anyone in particular but to the thead as a whole...
>
> 1. Nothing in the packager introduction process prepares a packager
> for what to do when they get a CVE filed against one of their
> packages. I found the whole ordeal rather stressful.
Agreed, this would be good to spell out.
> 4. I'm not a C/C++ programmer
Maybe I'm missing something, but why is being a C/C++ programmer
relevant to fixing security bugs? Are you packaging programs in a
language you don't speak?
Yes, I do that all the time. It's how I learn new things.
It's already intimidating for a new Fedora user to become a "Fedora
developer". Let's make that funnel of users->contributors wider.
- Ken