[Starlingx-discuss] Vulnerability Management guidelines - improving visibility

[Jeremy Stanley]

On 2023-07-14 18:07:05 +0000 (+0000), Geary, Stephen (Steve) wrote:
> I read the issue as more than visibility. I see an opportunity, if
> not need, to adopt best practices and industry standard practices
> associated with vulnerability reporting and management. Maybe we
> could look to OpenSSF for ideas and first steps:
> https://github.com/ossf/wg-vulnerability-disclosures/blob/main/README.md
[...]

For what it's worth, the OpenStack Vulnerability Management Process
(on which StarlingX's is based) was a major source of inspiration
for the eventual OpenSSF guidelines and can be found referenced in
the bibliography section here:

https://github.com/ossf/oss-vulnerability-guide/blob/main/finder-guide.md#bibliography

As well as the acknowledgements here:

https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md#acknowledgements

More input is always useful, which is why we got involved in the
drafting of those guidelines to begin with. (Full disclosure for
those who don't know me: I'm the longest serving member of the
OpenStack VMT and was consulted on the original OpenSSF guidelines,
so do have some history with it.) What are your concerns with the
current processes being followed, and what sorts of ideas
specifically are you looking for?
-- 
Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <https://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20230714/e94eb5ce/attachment.sig>