Public SourceMage Discussion List

[Jeremy Blosser <jblosser-smgl AT firinn.org>]

On Mar 08, George Sherwood [pilot AT beernabeer.com] wrote:
> The only time in my experience that security update process was working
> well, was when there was a security lead that was dedicated.  We need
> to find a person that is willing to spend the time to make these
> updates happen.

My concern is that if we continue to tie this to having a dedicated person,
we continue to get burned if we can't find that person or if they take a
vacation.  I don't like things that rely on one person being willing.

Obviously processes don't do any good if no one is willing to enact them,
but I think our regular devs are happy to do security updates when they
know about them.  It's knowing about them that is a trick.  Usually the
security lead mostly performed the task of trawling bugtraq/etc. for
relevant things, and that can be a daunting task.

Do any of the candidates have thoughts around how this process could be
made more redundant or possibly automated?

Attachment: pgpB8XCZflfzh.pgp
Description: PGP signature