Re: DragonFly Security Officer and Security Team

[Hiten Pandya <hmp@xxxxxxxxxxxxx>]

It is not just about picking committers with free time and better 
understanding of code.  The people elected should have more than 
adequate knowledge of security concepts.

To conclude, all I am saying is that such a team is not necessary right 
now; but... when we do plan on creating such a team, I would rather put 
people with proven track record in security related things and just 
anyone.  I do not mean to offend anyone's attempt at contribution or 
giving their time.

Kind regards,

     Hiten Pandya

Devon H. O'Dell wrote:
> Hello all,
>
> ``Who can act as a security officer and participate in a security team 
> for our project?''
>
> This is a question that I've discussed before with the members of 
> #DragonFlyBSD when I joined the project. At the time, it seemed to be 
> considered a bit of an unnecessary position. I think as our project 
> grows, we will need to formalize this matter a bit. There are good, 
> specific reasons to organize a team and a head for this matter; it makes 
> inter-project communication regarding security vulnerabilities easier 
> and safer.
>
> Unfortunately, obscurity is critical when a vulnerability is discovered. 
> As it stands, it is difficult to find anybody to contact privately when 
> such a matter is revealed. It may or may not be obvious to some who the 
> head developers of the project are and it may or may not be obvious 
> whether or not they have time to deal with the issue.
>
> I think formalization of this issue is in order. I certainly have time 
> to work in a team and I can probably even allocate enough to act as an 
> officer, but I'm not a committer and have contributed relatively little 
> to the project code-wise (the lockf(2) patch being virtually everything, 
> disregarding installer work and giving my 2 cents on every subject 
> that's discussed on IRC), so I'm not sure that I am the most qualified 
> person for either of these positions.
>
> I'm certainly up for serving as either (officer / team member) and 
> failing either would certainly work to coordinate the gathering of a 
> team which is qualified for such a position.
>
> I hope we can get something worked out with this.
>
> Kind regards,
>
> Devon H. O'Dell