[Starlingx-discuss] Vulnerability Management guidelines - improving visibility

Fri Jul 14 18:07:05 UTC 2023

I read the issue as more than visibility. I see an opportunity, if not need, to adopt best practices and industry standard practices associated with vulnerability reporting and management. Maybe we could look to OpenSSF for ideas and first steps: https://github.com/ossf/wg-vulnerability-disclosures/blob/main/README.md

-steve

-----Original Message-----
From: starlingx-discuss-request at lists.starlingx.io <starlingx-discuss-request at lists.starlingx.io> 
Sent: Wednesday, July 12, 2023 6:30 AM
To: starlingx-discuss at lists.starlingx.io
Subject: Starlingx-discuss Digest, Vol 62, Issue 22

CAUTION: This email comes from a non Wind River email account!
Do not click links or open attachments unless you recognize the sender and know the content is safe.

Send Starlingx-discuss mailing list submissions to
        starlingx-discuss at lists.starlingx.io

To subscribe or unsubscribe via the World Wide Web, visit
        https://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss
or, via email, send a message with subject or body 'help' to
        starlingx-discuss-request at lists.starlingx.io

You can reach the person managing the list at
        starlingx-discuss-owner at lists.starlingx.io

When replying, please edit your Subject line so it is more specific than "Re: Contents of Starlingx-discuss digest..."

Today's Topics:

   1. Vulnerability Management guidelines - improving visibility
      (Ildiko Vancsa)
   2. Re: Vulnerability Management guidelines - improving
      visibility (Waines, Greg)

----------------------------------------------------------------------

Message: 1
Date: Tue, 11 Jul 2023 13:51:02 -0700
From: Ildiko Vancsa <ildiko at openinfra.dev>
To: StarlingX ML <starlingx-discuss at lists.starlingx.io>
Subject: [Starlingx-discuss] Vulnerability Management guidelines -
        improving visibility
Message-ID: <E4EE8A0C-09FF-4F3F-B81E-723E0B51CD74 at openinfra.dev>
Content-Type: text/plain;       charset=utf-8

Hi StarlingX Community,

The StarlingX project has been gaining new users and contributors lately, and the community already started to look into providing more on-boarding related materials and help people to find their ways around.

Related to the above, I wanted to bring up the project?s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find.

Would it make sense to move the content of the aforementioned wiki over to the Documentation website? Regardless of where the information lives, where do you think would be good to add pointers to it, ie. the project?s homepage, the docs homepage, etc?

Best Regards,
Ildik?

[1] https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management

???

Ildik? V?ncsa
Director of Community
Open Infrastructure Foundation

------------------------------

Message: 2
Date: Wed, 12 Jul 2023 11:49:20 +0000
From: "Waines, Greg" <Greg.Waines at windriver.com>
To: Ildiko Vancsa <ildiko at openinfra.dev>, StarlingX ML
        <starlingx-discuss at lists.starlingx.io>
Subject: Re: [Starlingx-discuss] Vulnerability Management guidelines -
        improving visibility
Message-ID:
        <CO1PR11MB50907AF53BD6F4621E2FECE4E536A at CO1PR11MB5090.namprd11.prod.outlook.com>

Content-Type: text/plain; charset="utf-8"

We do have a high level view of 'CVE Maintenance' in docs.starlingx.io .
https://docs.starlingx.io/security/kubernetes/cve-maintenance-723cd9dd54b3.html
We could provide a reference/link here to the more detailed page in the wiki .

Greg.

-----Original Message-----
From: Ildiko Vancsa <ildiko at openinfra.dev>
Sent: Tuesday, July 11, 2023 4:51 PM
To: StarlingX ML <starlingx-discuss at lists.starlingx.io>
Subject: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility