Add IRP and threat model outline #2192
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
While these have gone through some revision and discussion so far, they are always subject to iteration and improvement, both in general and in the particularly highlighted ways noted within them. Also, the IRP essentially only covers vulnerability handling right now, and the threat model outline is an outline (it does not model the attack surfaces or detailed use cases of each individual `gix-*` library crate). Reviewed-by: Sebastian Thiel <sebastian.thiel@icloud.com>
The main purpose of the readme is to help anybody who gets to this directory with the goal of reporting a vulnerability to find the documentation for doing so (which remains in `SECURITY.md`, not in this directory). But it also briefly explains the contents. The threat model notes also added here are not, even in principle, a policy, but I think they may be useful to have, to be able to refer to alongside the threat model outline.
Since there are more items in `etc` now, this may help to find things more easily.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This adds the incident response plan
irp.mdand threat model outlinethreat-model.md. They are the exact versions of those files we discussed and that you reviewed. To distinguish those from the other changes here, I've put aReviewed-by:trailer on the commit that introduces those; this is to avoid creating the wrong impression that you've reviewed the specific content of the other two Markdown files.The other two Markdown files added here are a readme inside
etc/security, mainly so if people who are looking forSECURITY.mdfind that directory with the IRP and threat model outline instead, then they will be able to find their way toSECURITY.md, but also to give a table of contents; and notes related to the threat model that overlap with them and do not even in principle have the status of a policy document but that seem to be of value to hold onto as well, at least for now.Because this adds another entry in
etc, I figured I'd also put the scripts inetcin ascriptssubdirectory. This required updating thejustfileandci.yml; assuming I got that right, then CI will pass. Therefore, if CI somehow fails here, then that should not be overridden, at least not without dropping that third commit.This is still a draft because I just want to make sure links work, everything renders as intended, and also see if I can make the note at the top of theDone.etc/securityreadme more apparent.