Security Policy Process Amendment

Development
,
1

Hi everyone,

I’d like to remove the step 3 from our official process for handling security issue as written in https://dev.xwiki.org/xwiki/bin/view/Community/SecurityPolicy/#HWhat2019stheprocesstohandlesecurityissuesforcommitters3F:

  1. Announce the problem on the security section of the forum

because we just never do it in practice. We do announce on the forum when we actually fixed the security issue (which is step 7 in our current process) because we do have all the info then. Step 3 looks redundant with the actual list of security issues on jira which is also sent on the security ML regularly and that anyone who is granted security access can check directly on jira.

I’ll do the removal in the end of the week unless somebody disagrees.

2

+1

3

+0

Thanks,
Marius

4

+0 as in theory it would be beneficial to be open and announce issues early.
But, in practice:

  1. we don’t do it
  2. interested people can easily follow Jira for security issues
5

Changes are done: https://dev.xwiki.org/xwiki/bin/view/Community/SecurityPolicy/?viewer=changes&rev1=22.1&rev2=23.1&