[Starlingx-discuss] Vulnerability Management guidelines - improving visibility

[Ildiko Vancsa]

Hi Greg,

Thank you for sharing that pointer.

There are multiple aspects to security and vulnerability related features, activities and actions. The documentation website mainly covers the features in the platform. In addition, the page that you shared also talks about the CVE scan process and briefly mentions the security team.

I think it is great to have documentation available about the CVE scans. At the same time, the placement of the link to the page makes it a little hidden in the list of related features in the platform. The page also says that “the master development branch of StarlingX is scanned for CVEs” and does not say anything about Kubernetes in particular, however, it is listed under a Kubernetes section. Is there a specific reason for that?

I think it would be great to separate the features from the activities, including what users can do if they identify a vulnerability issue. And make that information much more visible and easy to find. We can also add the CVE scan related information there. What do you think?

Thanks,
Ildikó

———

Ildikó Váncsa
Director of Community
Open Infrastructure Foundation





> On Jul 12, 2023, at 04:49, Waines, Greg <Greg.Waines at windriver.com> wrote:
> 
> We do have a high level view of 'CVE Maintenance' in docs.starlingx.io .
> https://docs.starlingx.io/security/kubernetes/cve-maintenance-723cd9dd54b3.html
> We could provide a reference/link here to the more detailed page in the wiki .
> 
> Greg.
> 
> -----Original Message-----
> From: Ildiko Vancsa <ildiko at openinfra.dev> 
> Sent: Tuesday, July 11, 2023 4:51 PM
> To: StarlingX ML <starlingx-discuss at lists.starlingx.io>
> Subject: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility
> 
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender and know the content is safe.
> 
> Hi StarlingX Community,
> 
> The StarlingX project has been gaining new users and contributors lately, and the community already started to look into providing more on-boarding related materials and help people to find their ways around.
> 
> Related to the above, I wanted to bring up the project’s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find.
> 
> Would it make sense to move the content of the aforementioned wiki over to the Documentation website? Regardless of where the information lives, where do you think would be good to add pointers to it, ie. the project’s homepage, the docs homepage, etc?
> 
> Best Regards,
> Ildikó
> 
> [1] https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management
> 
> ———
> 
> Ildikó Váncsa
> Director of Community
> Open Infrastructure Foundation
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io