On 2023-07-14 18:07:05 +0000 (+0000), Geary, Stephen (Steve) wrote:
I read the issue as more than visibility. I see an opportunity, if not need, to adopt best practices and industry standard practices associated with vulnerability reporting and management. Maybe we could look to OpenSSF for ideas and first steps: https://github.com/ossf/wg-vulnerability-disclosures/blob/main/README.md [...]
For what it's worth, the OpenStack Vulnerability Management Process (on which StarlingX's is based) was a major source of inspiration for the eventual OpenSSF guidelines and can be found referenced in the bibliography section here: https://github.com/ossf/oss-vulnerability-guide/blob/main/finder-guide.md#bi... As well as the acknowledgements here: https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.m... More input is always useful, which is why we got involved in the drafting of those guidelines to begin with. (Full disclosure for those who don't know me: I'm the longest serving member of the OpenStack VMT and was consulted on the original OpenSSF guidelines, so do have some history with it.) What are your concerns with the current processes being followed, and what sorts of ideas specifically are you looking for? -- Jeremy Stanley