Security policy process amendment: Stop announcing advisories on the forum

Development
1

Hi everyone,

this is a follow up of Security Policy: Stop announcing advisories on the forum I invite you to read that thread for details.

This vote is about removing:

Announce the fix on the security category of the forum with the list of branches where the fix is provided and the link to the advisory

in the security policy process for handling advisories. The idea being that announcement are made directly through notifications in the Security advisory app and people interested are part of the security group that are able to receive those notifications.

I’m opening the vote until friday 10th of july

Here’s my +1.

2

+1 thanks

3

+1

Thanks,
Marius

4

+1

5

+1

6

+1

But is there a process where all members of this security forum are gaining view rights to the new advisory app?

Second is there a possibility to inform all members here by mail to watch the advisory app?

I guess not all members of this forum are as mad as me visiting the forum nearly every day.

7

It’s already part of the process when adding a new security member (documented in https://dev.xwiki.org/xwiki/bin/view/Community/SecurityPolicy/#HAddinganewsecuritymember). Honestly I’m not entirely sure why you were not properly added in the security group on xwiki.org in the first place.

But I could indeed review the groups to ensure no one else is missing.

I guess I could do that directly as part of my review of the forum security group: to send a private message informing them about that change.

1 Like
8

I guess it’s enough to send a post on the security category to announce the change.

Then everyone will receive email notifications from the forum.

Thanks

9

+1

10

Closing this vote with +5 committers vote and +2 non-committers.

I applied the changes in the security policy: https://dev.xwiki.org/xwiki/bin/view/Community/SecurityPolicy/?viewer=changes&rev1=47.2&rev2=49.1&

I’m going to review the list of security groups.