Add security policy (fixes #6)#13
Conversation
matteodelabre
force-pushed
the
add-security-policy
branch
from
699c6fb to
32f6135
Compare
raisjn
left a comment
raisjn
left a comment
There was a problem hiding this comment.
who has access to the email? is there an SLA on responding + fixing or do we just use industry standard?
I’m going to give access to the email to the maintainers, as with #12.
The current wording only says “as soon as possible”. What’s your opinion on this? I think we don’t really have the resources available to provide a SLA. |
Since we also say this, I don't think we really care to provide an SLA. |
|
https://en.wikipedia.org/wiki/Responsible_disclosure - the industry standard is 90 day before disclosing a vulnerability in software, but for package repositories, probably makes sense to look at debian or arch. https://www.debian.org/security/disclosure-policy debian is few days for initial response, then attempt to get fix in within 2 weeks (depending on severity). not sure what arch is, doesn't look specified. i think leaving it unspecified is fine. |
|
We can have an internal target of 2 weeks depending on severity, with a few days to respond. |
|
I agree with having an internal target rather than something explicit. LGTM. Who is authorised to merge? |
|
Not sure if we'd even need the email access. I think making the mail forward it to all of us would be fine. Some clubs are probably doing it similarly since responses usually come from their personal (but usually club specific) emails. But the current approach is probably better to keep up authenticity when responding from a random email and preventing duplicate answers. (Not sure what the state on the mail is, but I have a mailcow mail server that could double for this domain as well and give out domain-admin accounts.) |
Usually the person who started a PR also merges it. If you're okay with it, it would be cool if you can review it. |
@dixonary I think we are just waiting on you to approve the PR and we can merge. |
|
We just need your review before we can merge this @dixonary. Thanks! |
dixonary
left a comment
dixonary
left a comment
There was a problem hiding this comment.
Very sorry, I thought I had done this already!
|
Thanks! |
5 participants
No description provided.