You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@commons.apache.org by Stefan Bodewig <bo...@apache.org> on 2014/08/31 11:00:45 UTC
Top Level Security Page
Hi all
I was just browsing the security pages of some ASF projects and the
guidelines set by our security team[1] (preparing a talk, not because
there was any issue) and realized Commons didn't have a page describing
how to report security issues.
Since I'm the one who created the page for Compress[2] by mostly copying
the Tomcat page in 2012 I know at least one component has such a page.
FileUpload which fixed a security issue with the 1.3.1 doesn't have a
page of its own.
I'd like to create a top level page for Commons about reporting security
issues. Basically I'd take the "Reporting New Security Problems" and
"Errors and Ommissions" sections from Compress' page and add a section
linking to component specific subpages as they exist. I'd like to see
this page linked in either the "Commons" or "General Information"
section of the navigation (which probably means doing something with
parent, I'll need to sort this out).
Comments?
Stefan
[1] http://www.apache.org/security/committers.html
[2] http://commons.apache.org/proper/commons-compress/security.html
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Top Level Security Page
Posted by Gary Gregory <ga...@gmail.com>.
ah, I have HttpsEverywhere and it redirs my request to HTTPS which there is
none, plain HTTP works. Looks good.
Gary
On Wed, Sep 10, 2014 at 7:39 AM, Stefan Bodewig <bo...@apache.org> wrote:
> On 2014-09-10, Gary Gregory wrote:
>
> > Hm... "The requested URL /security.html was not found on this server."
>
> I copy pasted the link from my browser. The page has been there for
> almost two weeks now, so we can rule out stale caches.
>
> Are you sure you are trying the URL that contains "staging" inside the
> FQDN?
>
> >> http://commons.staging.apache.org/security.html
>
> Stefan
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
--
E-Mail: garydgregory@gmail.com | ggregory@apache.org
Java Persistence with Hibernate, Second Edition
<http://www.manning.com/bauer3/>
JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
Spring Batch in Action <http://www.manning.com/templier/>
Blog: http://garygregory.wordpress.com
Home: http://garygregory.com/
Tweet! http://twitter.com/GaryGregory
Re: Top Level Security Page
Posted by Stefan Bodewig <bo...@apache.org>.
On 2014-09-10, Gary Gregory wrote:
> Hm... "The requested URL /security.html was not found on this server."
I copy pasted the link from my browser. The page has been there for
almost two weeks now, so we can rule out stale caches.
Are you sure you are trying the URL that contains "staging" inside the
FQDN?
>> http://commons.staging.apache.org/security.html
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org
Re: Top Level Security Page
Posted by Gary Gregory <ga...@gmail.com>.
Hm... "The requested URL /security.html was not found on this server."
Gary
On Wed, Sep 10, 2014 at 6:16 AM, Stefan Bodewig <bo...@apache.org> wrote:
> Hi
>
> I've just added a link to the security page inside the main navigation,
> see
>
> http://commons.staging.apache.org/security.html
>
> The page is inside the staging area only, but I'd like to publish it
> sooner rather than later - and update the commons parent to include the
> same link.
>
> Should the link be in a different section? Any other comments or
> objections?
>
> Stefan
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
> For additional commands, e-mail: dev-help@commons.apache.org
>
>
--
E-Mail: garydgregory@gmail.com | ggregory@apache.org
Java Persistence with Hibernate, Second Edition
<http://www.manning.com/bauer3/>
JUnit in Action, Second Edition <http://www.manning.com/tahchiev/>
Spring Batch in Action <http://www.manning.com/templier/>
Blog: http://garygregory.wordpress.com
Home: http://garygregory.com/
Tweet! http://twitter.com/GaryGregory
Re: Top Level Security Page
Posted by Stefan Bodewig <bo...@apache.org>.
Hi
I've just added a link to the security page inside the main navigation,
see
http://commons.staging.apache.org/security.html
The page is inside the staging area only, but I'd like to publish it
sooner rather than later - and update the commons parent to include the
same link.
Should the link be in a different section? Any other comments or
objections?
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@commons.apache.org
For additional commands, e-mail: dev-help@commons.apache.org