I read the issue as more than visibility. I see an opportunity, if not need, to adopt best practices and industry standard practices associated with vulnerability reporting and management. Maybe we could look to OpenSSF for ideas and first steps: https://github.com/ossf/wg-vulnerability-disclosures/blob/main/README.md -steve -----Original Message----- From: starlingx-discuss-request@lists.starlingx.io <starlingx-discuss-request@lists.starlingx.io> Sent: Wednesday, July 12, 2023 6:30 AM To: starlingx-discuss@lists.starlingx.io Subject: Starlingx-discuss Digest, Vol 62, Issue 22 CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe. Send Starlingx-discuss mailing list submissions to starlingx-discuss@lists.starlingx.io To subscribe or unsubscribe via the World Wide Web, visit https://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss or, via email, send a message with subject or body 'help' to starlingx-discuss-request@lists.starlingx.io You can reach the person managing the list at starlingx-discuss-owner@lists.starlingx.io When replying, please edit your Subject line so it is more specific than "Re: Contents of Starlingx-discuss digest..." Today's Topics: 1. Vulnerability Management guidelines - improving visibility (Ildiko Vancsa) 2. Re: Vulnerability Management guidelines - improving visibility (Waines, Greg) ---------------------------------------------------------------------- Message: 1 Date: Tue, 11 Jul 2023 13:51:02 -0700 From: Ildiko Vancsa <ildiko@openinfra.dev> To: StarlingX ML <starlingx-discuss@lists.starlingx.io> Subject: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility Message-ID: <E4EE8A0C-09FF-4F3F-B81E-723E0B51CD74@openinfra.dev> Content-Type: text/plain; charset=utf-8 Hi StarlingX Community, The StarlingX project has been gaining new users and contributors lately, and the community already started to look into providing more on-boarding related materials and help people to find their ways around. Related to the above, I wanted to bring up the project?s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find. Would it make sense to move the content of the aforementioned wiki over to the Documentation website? Regardless of where the information lives, where do you think would be good to add pointers to it, ie. the project?s homepage, the docs homepage, etc? Best Regards, Ildik? [1] https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ??? Ildik? V?ncsa Director of Community Open Infrastructure Foundation ------------------------------ Message: 2 Date: Wed, 12 Jul 2023 11:49:20 +0000 From: "Waines, Greg" <Greg.Waines@windriver.com> To: Ildiko Vancsa <ildiko@openinfra.dev>, StarlingX ML <starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility Message-ID: <CO1PR11MB50907AF53BD6F4621E2FECE4E536A@CO1PR11MB5090.namprd11.prod.outlook.com> Content-Type: text/plain; charset="utf-8" We do have a high level view of 'CVE Maintenance' in docs.starlingx.io . https://docs.starlingx.io/security/kubernetes/cve-maintenance-723cd9dd54b3.h... We could provide a reference/link here to the more detailed page in the wiki . Greg. -----Original Message----- From: Ildiko Vancsa <ildiko@openinfra.dev> Sent: Tuesday, July 11, 2023 4:51 PM To: StarlingX ML <starlingx-discuss@lists.starlingx.io> Subject: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi StarlingX Community, The StarlingX project has been gaining new users and contributors lately, and the community already started to look into providing more on-boarding related materials and help people to find their ways around. Related to the above, I wanted to bring up the project?s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find. Would it make sense to move the content of the aforementioned wiki over to the Documentation website? Regardless of where the information lives, where do you think would be good to add pointers to it, ie. the project?s homepage, the docs homepage, etc? Best Regards, Ildik? [1] https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ??? Ildik? V?ncsa Director of Community Open Infrastructure Foundation _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io ------------------------------ Subject: Digest Footer _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io ------------------------------ End of Starlingx-discuss Digest, Vol 62, Issue 22 *************************************************