On Mon, 2015-11-30 at 09:56 -0500, Eric Christensen wrote:
The Solution
----------------
The first piece of the solution will be an apprenticeship where new
FST members can prove themselves and get up to speed (similar to what
Infrastructure has).
This sounds sensible to me.
The second piece of the solution will be the establishment of a
private group in BZ that allows trusted members of the FST access to
sensitive information.
Third is the possibility of private builds in Koji. While we can do
private builds to maintain confidentiality of the vulnerability it
would be better to make sure that the build is done correctly and is
available for immediate QA.
Last is a "gentleman's agreement" that those in the trusted group
will maintain confidentiality and abide by certain information
security measures to prevent a leak of information.
It should be noted that none of these private mechanisms are in place
to maintain indefinite confidentiality; quite the opposite, in
fact. ALL work done in BZ will become public as soon as the embargo
expires. This is important to ensure transparency and openness in
this process and so as soon as we possibly can we want to provide the
community with all the information that is available.
The Work
------------
There is a lot of work that needs to be done to bring us to the point
of being ready to actively handle security issues (as opposed to just
chasing after vulnerabilities that are months/years old). The first,
and most basic, is education. It was suggested that we have some
sort of apprenticeship where we can bring in new people and help them
get up to speed. This would also give us time to instill the need
for trust. I've started compiling information on the
apprenticeship[0] but it needs more eyes/hands.
We also need to work on a workflow that includes proper protections
of embargoed information and a policy for working with embargoed
information.
Thoughts? Comments? Lets get a discussion going here.
I am new to using Fedora on a regular basis and just learning the
'Fedora Way' of doing things, but all of the ideas and plans sound
solid to me. I can only hope to be able to devote some time to learning
the skills necessary to help with this effort.
--
Charles Profitt
Open Source Advocate
https://ftbeowulf.wordpress.com/
4096R/37BEB021
D8A5 6061 25C3 28B7 2264 2B39 3E13 4DD2 37BE B021