On 2023-07-13 11:30:43 +0000 (+0000), Waines, Greg wrote: [...]
Wrt to making this info (i.e. https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ) more visible. Currently it requires you to navigate as follows: - StarlingX WIKI https://wiki.openstack.org/wiki/StarlingX - StarlingX sub-projects > Security project https://wiki.openstack.org/wiki/StarlingX/Security - Select 'Vulnerability Management Process' https://wiki.openstack.org/wiki/StarlingX/Security#Vulnerability_Management_... - Select ' See https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management '
We could put an additional direct link to it higher in the WIKI - maybe under 'Planning & Processes' [...]
I'm not sure your Vulnerability Management Process document is what needs increased visibility. Stepping back a bit, if I'm a StarlingX user who isn't well-connected with the contributor community and I find a misbehavior in the platform that I think might have security implications, I'll likely want to know how to safely report that to the StarlingX maintainers. I'm going to go to https://starlingx.io/ and start looking for information on how to report security issues. I'll keyword search for "security" on the main page of that project site and find that it appears twice, but associated with a link to a video about tamper resistance features, so that's not it. I'll maybe try searching for "vu..." nope nothing. Okay maybe it's on the FAQs page? No, not there either. In the docs? Oh hey look, there's a security section. Never mind, it's about more security features of the platform. I might eventually stumble on that kinda subtle link to the StarlingX wiki from the main documentation page and find the link there to the Security sub-project and then the https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is... section therein, but it's also quite possible I will have given up before getting that far, or asked on a mailing list and naively disclosed some details of a vulnerability when doing so. My suggestion is to get a link to that Security sub-team page in the footers of everything on the starlingx.io and docs.starlingx.io sites. Keeping https://wiki.openstack.org/wiki/StarlingX/Security in a wiki page is fine if you don't think it's suitable to move into your docs repository (or to have a separate repository the Security sub-team can use for their publications), but I also recommend moving the bug reporting instructions farther up that page. Ideally it would be about the first thing someone sees when landing there (perhaps after a brief intro paragraph). -- Jeremy Stanley