You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "potiuk (via GitHub)" <gi...@apache.org> on 2023/12/04 12:08:23 UTC
[PR] Add security team rotation proposal to our security team process [airflow]
potiuk opened a new pull request, #36049:
URL: https://github.com/apache/airflow/pull/36049
Time to reflect on the security team setup we have come up with few months ago. It's been a very successful endevour, but in order to keep it up - including the engagement and avoid burnout, we are introducing the concept of rotating security team members.
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
<!-- Please keep an empty line above the dashes. -->
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/CONTRIBUTING.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [newsfragments](https://github.com/apache/airflow/tree/main/newsfragments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add security team rotation proposal to our security team process [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #36049:
URL: https://github.com/apache/airflow/pull/36049#issuecomment-1846217987
Time to merge, I think, and start following up :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add security team rotation proposal to our security team process [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #36049:
URL: https://github.com/apache/airflow/pull/36049
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add security team rotation proposal to our security team process [airflow]
Posted by "pankajkoti (via GitHub)" <gi...@apache.org>.
pankajkoti commented on code in PR #36049:
URL: https://github.com/apache/airflow/pull/36049#discussion_r1413792094
##########
CONTRIBUTING.rst:
##########
@@ -216,6 +216,45 @@ There are certain expectations from the members of the security team:
`Severity Rating blog post <https://security.apache.org/blog/severityrating/>`_ by the Apache Software
Foundation Security team.
+Periodic Security team rotation
+-------------------------------
+
+Handling security issues is something of a chore, it takes vigilance, requires quick reaction and responses
+and often requires to act outside of the regular "day" job. This means that not everyone can keep up with
+being part of the security team for long while being engaged and active. While we do not expect all the
+security team member to be active all the time, and - since we are volunteers, it's perfectly understandable
+that work, personal life, family and generally life might not help with being active. And this is not a
+considered as being failure, it's more stating the fact of life.
+
+Also prolonged time of being exposed to handling "other's" problems and discussing similar kinds of problem
+and responses might be tiring and might lead to burnout.
+
+However, for those who have never done that before, participation in the security team might be an interesting
+experience and a way to learn a lot about security and security issue handling. We have a lot of
+established processes and tools that make the work of the security team members easier so this can be
+treated as well as great learning experience for some community members. And knowing that this is not
Review Comment:
```suggestion
established processes and tools that make the work of the security team members easier, so this can be
treated as a great learning experience for some community members. And knowing that this is not
```
##########
CONTRIBUTING.rst:
##########
@@ -216,6 +216,45 @@ There are certain expectations from the members of the security team:
`Severity Rating blog post <https://security.apache.org/blog/severityrating/>`_ by the Apache Software
Foundation Security team.
+Periodic Security team rotation
+-------------------------------
+
+Handling security issues is something of a chore, it takes vigilance, requires quick reaction and responses
+and often requires to act outside of the regular "day" job. This means that not everyone can keep up with
+being part of the security team for long while being engaged and active. While we do not expect all the
+security team member to be active all the time, and - since we are volunteers, it's perfectly understandable
Review Comment:
```suggestion
security team members to be active all the time, and - since we are volunteers, it's perfectly understandable
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Add security team rotation proposal to our security team process [airflow]
Posted by "vincbeck (via GitHub)" <gi...@apache.org>.
vincbeck commented on code in PR #36049:
URL: https://github.com/apache/airflow/pull/36049#discussion_r1419709392
##########
CONTRIBUTING.rst:
##########
@@ -216,6 +216,45 @@ There are certain expectations from the members of the security team:
`Severity Rating blog post <https://security.apache.org/blog/severityrating/>`_ by the Apache Software
Foundation Security team.
+Periodic Security team rotation
+-------------------------------
+
+Handling security issues is something of a chore, it takes vigilance, requires quick reaction and responses
+and often requires to act outside of the regular "day" job. This means that not everyone can keep up with
+being part of the security team for long while being engaged and active. While we do not expect all the
+security team members to be active all the time, and - since we are volunteers, it's perfectly understandable
+that work, personal life, family and generally life might not help with being active. And this is not a
Review Comment:
```suggestion
that work, personal life, family and generally life might not help with being active. And this is not
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org