Public SourceMage Discussion List

[Jeremy Blosser <jblosser-smgl AT firinn.org>]

On Mar 08, "Andra?? 'ruskie' Levstik" [ruskie AT mages.ath.cx] wrote:
> On 16:11:35 2007-03-08 Jeremy Blosser <jblosser-smgl AT firinn.org> wrote:
> > On Mar 08, George Sherwood [pilot AT beernabeer.com] wrote:
> > > The only time in my experience that security update process was
> > > working well, was when there was a security lead that was dedicated.
> > > We need to find a person that is willing to spend the time to make
> > > these updates happen.
> > 
> > My concern is that if we continue to tie this to having a dedicated
> > person, we continue to get burned if we can't find that person or if
> > they take a vacation.  I don't like things that rely on one person
> > being willing.
> > 
> > Obviously processes don't do any good if no one is willing to enact
> > them, but I think our regular devs are happy to do security updates
> > when they know about them.  It's knowing about them that is a trick.
> > Usually the security lead mostly performed the task of trawling
> > bugtraq/etc. for relevant things, and that can be a daunting task.
> > 
> > Do any of the candidates have thoughts around how this process could be
> > made more redundant or possibly automated?
> 
> How about an in-grimoire security detail with 2-3 etc... ppl that would
> handle this and only this?

I doubt we can afford 2 or 3 people that only do one thing unless that's
the only thing they want to do anyway.  Like I said most devs are happy to
work on security updates once they hear about them.  And I just don't like
relying on people to make notifications happen.  People go on vacations or
go to sleep or burn out.  Computers don't.  If we can have an automated
process watch for security updates that are relevant and file bugs on them,
I think it would help a lot.  The question is what's the effort to do that
and does it make sense with our current resources.

Attachment: pgp4THqeNiPtn.pgp
Description: PGP signature