Public SourceMage Discussion List

["Andraž 'ruskie' Levstik" <ruskie AT mages.ath.cx>]

On 16:11:35 2007-03-08 Jeremy Blosser <jblosser-smgl AT firinn.org> wrote:
> On Mar 08, George Sherwood [pilot AT beernabeer.com] wrote:
> > The only time in my experience that security update process was
> > working well, was when there was a security lead that was dedicated.
> > We need to find a person that is willing to spend the time to make
> > these updates happen.
> 
> My concern is that if we continue to tie this to having a dedicated
> person, we continue to get burned if we can't find that person or if
> they take a vacation.  I don't like things that rely on one person
> being willing.
> 
> Obviously processes don't do any good if no one is willing to enact
> them, but I think our regular devs are happy to do security updates
> when they know about them.  It's knowing about them that is a trick.
> Usually the security lead mostly performed the task of trawling
> bugtraq/etc. for relevant things, and that can be a daunting task.
> 
> Do any of the candidates have thoughts around how this process could be
> made more redundant or possibly automated?

How about an in-grimoire security detail with 2-3 etc... ppl that would
handle this and only this?


--
Andraž "ruskie" Levstik
Source Mage GNU/Linux Games grimoire guru
Geek/Hacker/Tinker

Hacker FAQ: http://www.plethora.net/%7eseebs/faqs/hacker.html
Be sure brain is in gear before engaging mouth.

Key id = F4C1F89C
Key fingerprint = 6FF2 8F20 4C9D DB36 B5B6  F134 884D 72CC F4C1 F89C