Skip to Content.
Sympa Menu

sm-discuss - Re: [SM-Discuss] Grimoire Lead Vote 2007

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Jeremy Blosser <jblosser-smgl AT firinn.org>
  • To: sm-discuss AT lists.ibiblio.org
  • Subject: Re: [SM-Discuss] Grimoire Lead Vote 2007
  • Date: Thu, 8 Mar 2007 14:53:43 -0600

On Mar 08, "Andra?? 'ruskie' Levstik" [ruskie AT mages.ath.cx] wrote:
> On 16:11:35 2007-03-08 Jeremy Blosser <jblosser-smgl AT firinn.org> wrote:
> > On Mar 08, George Sherwood [pilot AT beernabeer.com] wrote:
> > > The only time in my experience that security update process was
> > > working well, was when there was a security lead that was dedicated.
> > > We need to find a person that is willing to spend the time to make
> > > these updates happen.
> >
> > My concern is that if we continue to tie this to having a dedicated
> > person, we continue to get burned if we can't find that person or if
> > they take a vacation. I don't like things that rely on one person
> > being willing.
> >
> > Obviously processes don't do any good if no one is willing to enact
> > them, but I think our regular devs are happy to do security updates
> > when they know about them. It's knowing about them that is a trick.
> > Usually the security lead mostly performed the task of trawling
> > bugtraq/etc. for relevant things, and that can be a daunting task.
> >
> > Do any of the candidates have thoughts around how this process could be
> > made more redundant or possibly automated?
>
> How about an in-grimoire security detail with 2-3 etc... ppl that would
> handle this and only this?

I doubt we can afford 2 or 3 people that only do one thing unless that's
the only thing they want to do anyway. Like I said most devs are happy to
work on security updates once they hear about them. And I just don't like
relying on people to make notifications happen. People go on vacations or
go to sleep or burn out. Computers don't. If we can have an automated
process watch for security updates that are relevant and file bugs on them,
I think it would help a lot. The question is what's the effort to do that
and does it make sense with our current resources.

Attachment: pgp4THqeNiPtn.pgp
Description: PGP signature




Archive powered by MHonArc 2.6.24.

Top of Page