DomainKey-Signature: a=rsa-sha1; c=nofws; d=toastin.space; h=subject:to
	:references:cc:from:message-id:date:mime-version:in-reply-to
	:content-type:content-transfer-encoding; q=dns; s=ml; b=CGGYbwi5
	uCpU8lb/1Q92lcTdr38ipcfjMZwh1JUvlANo3i6QzI+pyK1Dd1XFsGaKMkXb8sHu
	NMczrqGPceRCHLf8FqZfpO37RaK1TgZK2doS4tLslj/AOFHuzu86Uvyc78ZG/Lay
	ntX+reE8OpVOD8JsZ0bxZXo7L6H7sZgdoOFgzUH2X8ocG35QqboevrazRJx2afZ/
	0RdnmdO4PshifyVFItHORlW5dxE2ixccGrHeR4Yh0d4fFHcE8MutBUa4nE/Cce76
	zjfDMM4brdBytnorK1xcIPuXN0FdQpZZNv13DreOPyB77E6YqNJ9uhq6hL6MLbi8
	beQjJVX0ugi14g==
Subject: Re: [alpine-devel] Fw: Improving cross-distribution security
To: alpine-devel@lists.alpinelinux.org
References: <20190301214806.47a05e54@ncopa-desktop.copa.dup.pw>
 <X0NH0pqQNbp4KxGwVG0Vn8SxS6ZzVGgyLPIU1oBkJTew3rJcfgNBPK7fuPAicqZPwBbf3bDLsm3TE2M_qMcVBvOvbWBLuWnMH1DuFu37-oY=@duniel.no>
Cc: Daniel Isaksen <d@duniel.no>
From: Chloe Kudryavtsev <toast@toastin.space>
Message-ID: <809b52be-9b7a-6e9b-4a57-0ea1c0118954@toastin.space>
Date: Fri, 1 Mar 2019 21:19:01 -0500
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:66.0) Gecko/20100101
 Thunderbird/66.0
Precedence: list
MIME-Version: 1.0
In-Reply-To: <X0NH0pqQNbp4KxGwVG0Vn8SxS6ZzVGgyLPIU1oBkJTew3rJcfgNBPK7fuPAicqZPwBbf3bDLsm3TE2M_qMcVBvOvbWBLuWnMH1DuFu37-oY=@duniel.no>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit

On 3/1/2019 7:45 PM, Daniel Isaksen wrote:
> This is a great initiative, and we really need to get Working Groups (WGs) /
> Special Interest Groups (SIGs) formally set up. A while ago, I created a draft
> document[1] describing how to create and operate them. If you strongly
> disapprove of Google, email me, and I can return you a PDF copy.
> 
> So, I'll be short: what do you, the Alpine developers, think of this proposal?
> Could any of you help me with said document? I am on the (somewhat loosely
> defined) 'infrastructure team', so I will be able to help out with the technical
> aspect.
> 
> My personal opinion is that we need a team of (at least semi-)dedicated people
> on a Security SIG to first and foremost:
> - Maintain a security advisory program as a service for Alpine users.
> - Make sure we are properly tracking and patching new vulnerabilities, both
>    through open-source intelligence and information sharing with other
>    distributions.
> 
> [1]: https://docs.google.com/document/d/1TIGk24yLdoAC-JAH7IQzCAkxzX_YocUiHVbeSt-WZsk/edit?usp=sharing

I disagree with your outlined approach, for various reasons.
After a discussion over on IRC, we agreed on a more general team-based 
management approach.
Please find the resulting draft proposal here[1].

We also both agreed that something along these lines must be done, for 
many reasons.
Kaniini has also expressed preemptive support in #alpine-devel.

Hopefully, a deeper and more detailed discussion will take place (likely 
over IRC) within the next few days.

[1]: https://p.toastin.space/F7MDfw?asciidoc


---
Unsubscribe:  alpine-devel+unsubscribe@lists.alpinelinux.org
Help:         alpine-devel+help@lists.alpinelinux.org
---