Public SourceMage Discussion List

[Andrew <afrayedknot AT thefrayedknot.armory.com>]

On Fri, Apr 08, 2005 at 08:59:13AM +0200, Thomas Houssin wrote:
> 
> OK then a few words about me : my name's Thomas, 23. I'm french,
> currently finishing my studies (computer and network, major security).
> The security field I'll work on are the one Seth described (mostly
> security updates, security-related areas in Sorcery,...).
> 
> I also would like to start a hardened SM project (we talked about this
> idea a few days ago) : adding additional options/spells to the distro to
> use the various patches and programs improving security, for example to
> prevent buffer overflow attacks or add ACL support, and document them.
> About documentations, I'd like also to begin some kind of guide to
> describe steps and programs config to have a secure base install (PAM,
> which Arjan already volunteered to write on ;) , iptables, ...).
> 

Im going to voice my one and only concern, then I'll shut up :-)

Unlike most other things grimoire and sorcery related, on the security
team patches normally need to be applied asap, and its a bit of busy-work,
grimoire and sorcery updates are usually less time critical. Seth has done a
good job of staying on top of security updates and its usually quite a
selling point for us that we're about as up-to-date as possible. So I
just want to make sure that Thomas is aware of this and is committed to
stay on top of patches and get them in as quickly as possible (and/or
find other people to help). I think patches are a much higher priority
than enhancing spells and stuff.

-Andrew


-- 
__________________________________________________________________________
|Andrew D. Stitt                           | astitt at sourcemage.org    |
|irc: afrayedknot                          | afrayedknot at t.armory.com |
|aim: thefrayedknot or iteratorplusplus    | acedit at armory.com        |
|Sorcery Team Lead                         | ftp://t.armory.com/         |
--------------------------------------------------------------------------

Attachment: pgpu9bAJPzqEP.pgp
Description: PGP signature