New channel for security fixes announcements in XWiki

[vmassol]

@MichaelHamann

Notifications inside XWiki won’t work for offline installations, and their admins should still have a way to be notified about important updates.

Good point re offline. I’m still convinced that 1) we’ll need that info inside of XWiki to push admins to upgrade and 2) that it shouldn’t make the RM job harder (ie it needs to be automated).

@surli

Right now release notes contain a very small piece of information regarding if it contains security fixes: only the impact of the worst vulnerability fixed in the release (see also discussions on that choice here: Indicate if there are security issues in the Release Notes)

Yes. And the reason for this is that we didn’t want to disclose more than that, not because it’s in the release notes.

@surli

how many vulnerabilities has been fixed with the affected versions

I had proposed this in Indicate if there are security issues in the Release Notes and it was refused. Now maybe opinions have changed

@surli

Also I’m hesitating between proposing to create a close ML or an open one: I don’t think it’s a problem to have it open.

Are you saying that it’s not a read-only ML? If not, what would it be used for (knowing that we already have security@xwiki.org). Or do you mean a read only list but archived and visible?

@surli

Finally if we provide all those info in this ML maybe we’d like to revise what we put in our RN to put same info, that’s probably to be discussed.

Yeah, ideally we would put all the info in the RN (possibly in a special xpropery) which should be the master place containing all info about a release, and have some automated process to send the mail to the security-announcement ML.

Thx