[Starlingx-discuss] Vulnerability Management guidelines - improving visibility

14 Jul 2023

      I read the issue as more than visibility. I see an opportunity, if not need, to adopt best practices and industry standard practices associated with vulnerability reporting and management. Maybe we could look to OpenSSF for ideas and first steps: https://github.com/ossf/wg-vulnerability-disclosures/blob/main/README.md

-steve

-----Original Message-----
From: starlingx-discuss-request@lists.starlingx.io <starlingx-discuss-request@lists.starlingx.io> 
Sent: Wednesday, July 12, 2023 6:30 AM
To: starlingx-discuss@lists.starlingx.io
Subject: Starlingx-discuss Digest, Vol 62, Issue 22

CAUTION: This email comes from a non Wind River email account!
Do not click links or open attachments unless you recognize the sender and know the content is safe.

Send Starlingx-discuss mailing list submissions to
        starlingx-discuss@lists.starlingx.io

To subscribe or unsubscribe via the World Wide Web, visit
        https://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
or, via email, send a message with subject or body 'help' to
        starlingx-discuss-request@lists.starlingx.io

You can reach the person managing the list at
        starlingx-discuss-owner@lists.starlingx.io

When replying, please edit your Subject line so it is more specific than "Re: Contents of Starlingx-discuss digest..."

Today's Topics:

   1. Vulnerability Management guidelines - improving visibility
      (Ildiko Vancsa)
   2. Re: Vulnerability Management guidelines - improving
      visibility (Waines, Greg)

----------------------------------------------------------------------

Message: 1
Date: Tue, 11 Jul 2023 13:51:02 -0700
From: Ildiko Vancsa <ildiko@openinfra.dev>
To: StarlingX ML <starlingx-discuss@lists.starlingx.io>
Subject: [Starlingx-discuss] Vulnerability Management guidelines -
        improving visibility
Message-ID: <E4EE8A0C-09FF-4F3F-B81E-723E0B51CD74@openinfra.dev>
Content-Type: text/plain;       charset=utf-8

Hi StarlingX Community,

The StarlingX project has been gaining new users and contributors lately, and the community already started to look into providing more on-boarding related materials and help people to find their ways around.

Related to the above, I wanted to bring up the project?s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find.

Would it make sense to move the content of the aforementioned wiki over to the Documentation website? Regardless of where the information lives, where do you think would be good to add pointers to it, ie. the project?s homepage, the docs homepage, etc?

Best Regards,
Ildik?

[1] https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management

???

Ildik? V?ncsa
Director of Community
Open Infrastructure Foundation

------------------------------

Message: 2
Date: Wed, 12 Jul 2023 11:49:20 +0000
From: "Waines, Greg" <Greg.Waines@windriver.com>
To: Ildiko Vancsa <ildiko@openinfra.dev>, StarlingX ML
        <starlingx-discuss@lists.starlingx.io>
Subject: Re: [Starlingx-discuss] Vulnerability Management guidelines -
        improving visibility
Message-ID:
        <CO1PR11MB50907AF53BD6F4621E2FECE4E536A@CO1PR11MB5090.namprd11.prod.outlook.com>

Content-Type: text/plain; charset="utf-8"

We do have a high level view of 'CVE Maintenance' in docs.starlingx.io .
https://docs.starlingx.io/security/kubernetes/cve-maintenance-723cd9dd54b3.h...
We could provide a reference/link here to the more detailed page in the wiki .

Greg.

-----Original Message-----
From: Ildiko Vancsa <ildiko@openinfra.dev>
Sent: Tuesday, July 11, 2023 4:51 PM
To: StarlingX ML <starlingx-discuss@lists.starlingx.io>
Subject: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility