You are viewing a plain text version of this content. The canonical link for it is here.
Posted to general@incubator.apache.org by PJ Fanning <fa...@apache.org> on 2025/03/06 15:02:40 UTC
Re: podling security issues
As a concrete proposal, can I suggest adding a question to the podling report.
Something like:
Is the podling PPMC being responsive to email threads on the private mailing list (don't discuss specific instances here because the threads are private)?
I know this is a long winded question that really only expects a yes/no answer or something like:
The PPMC has become less responsive recently. I will reach out to PPMC members to see if they can devote some more time to the private threads.
The idea of the question is to act as a reminder of the importance of the private email threads.
It would also be good if the shepherds also check the private threads when reviewing podling reports and report if they think there is a responsiveness issue.
On 2025/01/26 07:42:16 Jean-Baptiste Onofré wrote:
> Hi
>
> This is a good proposal. As part of the new reporting tool for
> project, it's a security section is part of the report.
>
> So, it makes sense to have it for podlings.
>
> Regards
> JB
>
> On Fri, Jan 24, 2025 at 2:35 PM PJ Fanning <fa...@gmail.com> wrote:
> >
> > Hi everyone,
> >
> > I didn't follow up on this when I raised it in December 2023. I'd like
> > to propose it again.
> > Basically, the idea is that the podling reports, that we do every 3
> > months, would have a question about whether the podling believes that
> > they are being sufficiently responsive to issues raised on their
> > private mailing list (particularly security issues). There would maybe
> > also be a reminder about the ASF policies related to dealing with
> > disclosures about vulnerabilities [1].
> > I would also like to see a section about this in the Graduation Report
> > - having podlings declare that they have been and intend to continue
> > to be responsive to disclosures about vulnerabilities. This is covered
> > by QU30 in the Project Maturity Model [2] but I wonder if the text
> > could be adjusted to also mention the need to be responsive to
> > vulnerability reports.
> > With efforts like the CRA [3] and other regulatory requirements around
> > the world, this area is becoming even more important.
> >
> > What do people think?
> >
> > Thanks,
> > PJ
> >
> > [1] https://www.apache.org/security/
> > [2] https://community.apache.org/apache-way/apache-project-maturity-model.html#quality
> > [3] https://en.wikipedia.org/wiki/Cyber_Resilience_Act
> >
> > On Wed, 13 Dec 2023 at 16:21, Craig Russell <ap...@gmail.com> wrote:
> > >
> > > Hi PJ,
> > >
> > > I agree that there should be a section in podlings' reports that highlights <private/> security issues.
> > >
> > > Regards,
> > > Craig
> > >
> > > > On Dec 13, 2023, at 05:22, PJ Fanning <fa...@apache.org> wrote:
> > > >
> > > > Hi everyone,
> > > >
> > > > I'm wondering if podlings should include some details about their
> > > > security issues [1] in their 3 podling reports. We won't want to
> > > > release information about any security issues that are still under
> > > > investigation or where the fix is not yet released. I still think
> > > > there is little harm in podlings giving high level numbers and maybe
> > > > some indication of how quickly security issues are being dealt with.
> > > >
> > > > I've seen evidence that some TLPs are unaware of the importance of
> > > > dealing quickly with security reports and I think the Incubator team
> > > > could help with ensuring that podlings are aware of the requirements.
> > > >
> > > > I will certainly be having a close look at a podling's record of
> > > > handling security reports when it comes to discussions about
> > > > graduation.
> > > >
> > > > I'm wondering if we could have some consensus on what is expected of podlings.
> > > >
> > > > Regards,
> > > > PJ
> > > >
> > > > [1] https://www.apache.org/security/
> > > >
> > > > ---------------------------------------------------------------------
> > > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > > > For additional commands, e-mail: general-help@incubator.apache.org
> > > >
> > >
> > > Craig L Russell
> > > clr@apache.org
> > >
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > > For additional commands, e-mail: general-help@incubator.apache.org
> > >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > For additional commands, e-mail: general-help@incubator.apache.org
> >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: podling security issues
Posted by PJ Fanning <fa...@apache.org>.
A simple yes/no question about the subscribers to the private list
seems fine to me.
On Thu, 6 Mar 2025 at 17:47, Craig Russell <ap...@gmail.com> wrote:
>
> Related, should we ask the podling if all PPMC members (and only PPMC members or invited outsiders) are subscribed to the private mail list?
>
> Craig
>
>
> > On Mar 6, 2025, at 07:02, PJ Fanning <fa...@apache.org> wrote:
> >
> > As a concrete proposal, can I suggest adding a question to the podling report.
> >
> > Something like:
> > Is the podling PPMC being responsive to email threads on the private mailing list (don't discuss specific instances here because the threads are private)?
> >
> > I know this is a long winded question that really only expects a yes/no answer or something like:
> > The PPMC has become less responsive recently. I will reach out to PPMC members to see if they can devote some more time to the private threads.
> >
> > The idea of the question is to act as a reminder of the importance of the private email threads.
> >
> > It would also be good if the shepherds also check the private threads when reviewing podling reports and report if they think there is a responsiveness issue.
> >
> >
> > On 2025/01/26 07:42:16 Jean-Baptiste Onofré wrote:
> >> Hi
> >>
> >> This is a good proposal. As part of the new reporting tool for
> >> project, it's a security section is part of the report.
> >>
> >> So, it makes sense to have it for podlings.
> >>
> >> Regards
> >> JB
> >>
> >> On Fri, Jan 24, 2025 at 2:35 PM PJ Fanning <fa...@gmail.com> wrote:
> >>>
> >>> Hi everyone,
> >>>
> >>> I didn't follow up on this when I raised it in December 2023. I'd like
> >>> to propose it again.
> >>> Basically, the idea is that the podling reports, that we do every 3
> >>> months, would have a question about whether the podling believes that
> >>> they are being sufficiently responsive to issues raised on their
> >>> private mailing list (particularly security issues). There would maybe
> >>> also be a reminder about the ASF policies related to dealing with
> >>> disclosures about vulnerabilities [1].
> >>> I would also like to see a section about this in the Graduation Report
> >>> - having podlings declare that they have been and intend to continue
> >>> to be responsive to disclosures about vulnerabilities. This is covered
> >>> by QU30 in the Project Maturity Model [2] but I wonder if the text
> >>> could be adjusted to also mention the need to be responsive to
> >>> vulnerability reports.
> >>> With efforts like the CRA [3] and other regulatory requirements around
> >>> the world, this area is becoming even more important.
> >>>
> >>> What do people think?
> >>>
> >>> Thanks,
> >>> PJ
> >>>
> >>> [1] https://www.apache.org/security/
> >>> [2] https://community.apache.org/apache-way/apache-project-maturity-model.html#quality
> >>> [3] https://en.wikipedia.org/wiki/Cyber_Resilience_Act
> >>>
> >>> On Wed, 13 Dec 2023 at 16:21, Craig Russell <ap...@gmail.com> wrote:
> >>>>
> >>>> Hi PJ,
> >>>>
> >>>> I agree that there should be a section in podlings' reports that highlights <private/> security issues.
> >>>>
> >>>> Regards,
> >>>> Craig
> >>>>
> >>>>> On Dec 13, 2023, at 05:22, PJ Fanning <fa...@apache.org> wrote:
> >>>>>
> >>>>> Hi everyone,
> >>>>>
> >>>>> I'm wondering if podlings should include some details about their
> >>>>> security issues [1] in their 3 podling reports. We won't want to
> >>>>> release information about any security issues that are still under
> >>>>> investigation or where the fix is not yet released. I still think
> >>>>> there is little harm in podlings giving high level numbers and maybe
> >>>>> some indication of how quickly security issues are being dealt with.
> >>>>>
> >>>>> I've seen evidence that some TLPs are unaware of the importance of
> >>>>> dealing quickly with security reports and I think the Incubator team
> >>>>> could help with ensuring that podlings are aware of the requirements.
> >>>>>
> >>>>> I will certainly be having a close look at a podling's record of
> >>>>> handling security reports when it comes to discussions about
> >>>>> graduation.
> >>>>>
> >>>>> I'm wondering if we could have some consensus on what is expected of podlings.
> >>>>>
> >>>>> Regards,
> >>>>> PJ
> >>>>>
> >>>>> [1] https://www.apache.org/security/
> >>>>>
> >>>>> ---------------------------------------------------------------------
> >>>>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >>>>> For additional commands, e-mail: general-help@incubator.apache.org
> >>>>>
> >>>>
> >>>> Craig L Russell
> >>>> clr@apache.org
> >>>>
> >>>>
> >>>> ---------------------------------------------------------------------
> >>>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >>>> For additional commands, e-mail: general-help@incubator.apache.org
> >>>>
> >>>
> >>> ---------------------------------------------------------------------
> >>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >>> For additional commands, e-mail: general-help@incubator.apache.org
> >>>
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> >> For additional commands, e-mail: general-help@incubator.apache.org
> >>
> >>
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > For additional commands, e-mail: general-help@incubator.apache.org
> >
>
> Craig L Russell
> clr@apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: podling security issues
Posted by Craig Russell <ap...@gmail.com>.
Related, should we ask the podling if all PPMC members (and only PPMC members or invited outsiders) are subscribed to the private mail list?
Craig
> On Mar 6, 2025, at 07:02, PJ Fanning <fa...@apache.org> wrote:
>
> As a concrete proposal, can I suggest adding a question to the podling report.
>
> Something like:
> Is the podling PPMC being responsive to email threads on the private mailing list (don't discuss specific instances here because the threads are private)?
>
> I know this is a long winded question that really only expects a yes/no answer or something like:
> The PPMC has become less responsive recently. I will reach out to PPMC members to see if they can devote some more time to the private threads.
>
> The idea of the question is to act as a reminder of the importance of the private email threads.
>
> It would also be good if the shepherds also check the private threads when reviewing podling reports and report if they think there is a responsiveness issue.
>
>
> On 2025/01/26 07:42:16 Jean-Baptiste Onofré wrote:
>> Hi
>>
>> This is a good proposal. As part of the new reporting tool for
>> project, it's a security section is part of the report.
>>
>> So, it makes sense to have it for podlings.
>>
>> Regards
>> JB
>>
>> On Fri, Jan 24, 2025 at 2:35 PM PJ Fanning <fa...@gmail.com> wrote:
>>>
>>> Hi everyone,
>>>
>>> I didn't follow up on this when I raised it in December 2023. I'd like
>>> to propose it again.
>>> Basically, the idea is that the podling reports, that we do every 3
>>> months, would have a question about whether the podling believes that
>>> they are being sufficiently responsive to issues raised on their
>>> private mailing list (particularly security issues). There would maybe
>>> also be a reminder about the ASF policies related to dealing with
>>> disclosures about vulnerabilities [1].
>>> I would also like to see a section about this in the Graduation Report
>>> - having podlings declare that they have been and intend to continue
>>> to be responsive to disclosures about vulnerabilities. This is covered
>>> by QU30 in the Project Maturity Model [2] but I wonder if the text
>>> could be adjusted to also mention the need to be responsive to
>>> vulnerability reports.
>>> With efforts like the CRA [3] and other regulatory requirements around
>>> the world, this area is becoming even more important.
>>>
>>> What do people think?
>>>
>>> Thanks,
>>> PJ
>>>
>>> [1] https://www.apache.org/security/
>>> [2] https://community.apache.org/apache-way/apache-project-maturity-model.html#quality
>>> [3] https://en.wikipedia.org/wiki/Cyber_Resilience_Act
>>>
>>> On Wed, 13 Dec 2023 at 16:21, Craig Russell <ap...@gmail.com> wrote:
>>>>
>>>> Hi PJ,
>>>>
>>>> I agree that there should be a section in podlings' reports that highlights <private/> security issues.
>>>>
>>>> Regards,
>>>> Craig
>>>>
>>>>> On Dec 13, 2023, at 05:22, PJ Fanning <fa...@apache.org> wrote:
>>>>>
>>>>> Hi everyone,
>>>>>
>>>>> I'm wondering if podlings should include some details about their
>>>>> security issues [1] in their 3 podling reports. We won't want to
>>>>> release information about any security issues that are still under
>>>>> investigation or where the fix is not yet released. I still think
>>>>> there is little harm in podlings giving high level numbers and maybe
>>>>> some indication of how quickly security issues are being dealt with.
>>>>>
>>>>> I've seen evidence that some TLPs are unaware of the importance of
>>>>> dealing quickly with security reports and I think the Incubator team
>>>>> could help with ensuring that podlings are aware of the requirements.
>>>>>
>>>>> I will certainly be having a close look at a podling's record of
>>>>> handling security reports when it comes to discussions about
>>>>> graduation.
>>>>>
>>>>> I'm wondering if we could have some consensus on what is expected of podlings.
>>>>>
>>>>> Regards,
>>>>> PJ
>>>>>
>>>>> [1] https://www.apache.org/security/
>>>>>
>>>>> ---------------------------------------------------------------------
>>>>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>>>>> For additional commands, e-mail: general-help@incubator.apache.org
>>>>>
>>>>
>>>> Craig L Russell
>>>> clr@apache.org
>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>>>> For additional commands, e-mail: general-help@incubator.apache.org
>>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>>> For additional commands, e-mail: general-help@incubator.apache.org
>>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
>> For additional commands, e-mail: general-help@incubator.apache.org
>>
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
Craig L Russell
clr@apache.org
Re: podling security issues
Posted by PJ Fanning <fa...@apache.org>.
I don't want to share numbers on a public forum but I just counted up
the number of podlings with active or recent security reports and it
seems things are not that rosy. It seems to me that podlings are about
as likely to get issues reported as ASF projects generally. I can post
some numbers on the private Incubator mailing list.
On Tue, 18 Mar 2025 at 23:48, Justin Mclean <ju...@classsoftware.com> wrote:
>
> Hi,
>
> While I have nothing against this idea, podlings rarely get security reports, and most never get them. Even if it occurred a few times a year, do we want to task all podlings this?
>
> Kind Regards,
> Justin
>
> > On 19 Mar 2025, at 2:07 AM, Shane Curcuru <as...@shanecurcuru.org> wrote:
> >
> > PJ Fanning wrote on 3/6/25 10:02 AM:
> >> As a concrete proposal, can I suggest adding a question to the podling report.
> >
> > Thanks for moving this to something concrete. Note as a general concept, I support this idea. Beefing up our documented processes around security handling is important, especially with legislation like the CRA coming our way in the future.
> >
> >> Something like:
> >> Is the podling PPMC being responsive to email threads on the private mailing list (don't discuss specific instances here because the threads are private)?
> >
> > This is a good start, but I would definitely expand this to ask about security issues in specific, because that is the critical factor in project governance.
> >
> > At the other end of the lifecycle, the defining factor of "Should the board force this dormant project into the Attic" is most often expressed as "Does this PMC still have three PMC members who could respond to a new security issue and push a release with a fix?"
> >
> > We should also ensure that PPMCs are made aware of Security requirements for TLPs, and how to handle vulnerabilities:
> >
> > https://www.apache.org/security/committers.html
> >
> >> I know this is a long winded question that really only expects a yes/no answer or something like:
> >> The PPMC has become less responsive recently. I will reach out to PPMC members to see if they can devote some more time to the private threads.
> >> The idea of the question is to act as a reminder of the importance of the private email threads.
> >
> > True - along with a reminder about including private information in any board reports (podling or TLP). A template answer here might be like this, to show that including a public answer to the question is important, but reminding people to use <private> markers for things that should not be made public in minutes.
> >
> > ----
> > Yes, the PPMC has been regularly reviewing private@ threads for activity lately.
> > <private>
> > The PPMC identified one incoming security report as invalid, and is investigating a second security report to see if we need a CVE. (or something like that)
> > </private>
> > ----
> >> It would also be good if the shepherds also check the private threads when reviewing podling reports and report if they think there is a responsiveness issue.
> >
> >
> > --
> > - Shane
> > Member
> > The Apache Software Foundation
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> > For additional commands, e-mail: general-help@incubator.apache.org
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: podling security issues
Posted by Justin Mclean <ju...@classsoftware.com>.
Hi,
While I have nothing against this idea, podlings rarely get security reports, and most never get them. Even if it occurred a few times a year, do we want to task all podlings this?
Kind Regards,
Justin
> On 19 Mar 2025, at 2:07 AM, Shane Curcuru <as...@shanecurcuru.org> wrote:
>
> PJ Fanning wrote on 3/6/25 10:02 AM:
>> As a concrete proposal, can I suggest adding a question to the podling report.
>
> Thanks for moving this to something concrete. Note as a general concept, I support this idea. Beefing up our documented processes around security handling is important, especially with legislation like the CRA coming our way in the future.
>
>> Something like:
>> Is the podling PPMC being responsive to email threads on the private mailing list (don't discuss specific instances here because the threads are private)?
>
> This is a good start, but I would definitely expand this to ask about security issues in specific, because that is the critical factor in project governance.
>
> At the other end of the lifecycle, the defining factor of "Should the board force this dormant project into the Attic" is most often expressed as "Does this PMC still have three PMC members who could respond to a new security issue and push a release with a fix?"
>
> We should also ensure that PPMCs are made aware of Security requirements for TLPs, and how to handle vulnerabilities:
>
> https://www.apache.org/security/committers.html
>
>> I know this is a long winded question that really only expects a yes/no answer or something like:
>> The PPMC has become less responsive recently. I will reach out to PPMC members to see if they can devote some more time to the private threads.
>> The idea of the question is to act as a reminder of the importance of the private email threads.
>
> True - along with a reminder about including private information in any board reports (podling or TLP). A template answer here might be like this, to show that including a public answer to the question is important, but reminding people to use <private> markers for things that should not be made public in minutes.
>
> ----
> Yes, the PPMC has been regularly reviewing private@ threads for activity lately.
> <private>
> The PPMC identified one incoming security report as invalid, and is investigating a second security report to see if we need a CVE. (or something like that)
> </private>
> ----
>> It would also be good if the shepherds also check the private threads when reviewing podling reports and report if they think there is a responsiveness issue.
>
>
> --
> - Shane
> Member
> The Apache Software Foundation
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org
Re: podling security issues
Posted by Shane Curcuru <as...@shanecurcuru.org>.
PJ Fanning wrote on 3/6/25 10:02 AM:
> As a concrete proposal, can I suggest adding a question to the podling report.
Thanks for moving this to something concrete. Note as a general
concept, I support this idea. Beefing up our documented processes
around security handling is important, especially with legislation like
the CRA coming our way in the future.
> Something like:
> Is the podling PPMC being responsive to email threads on the private mailing list (don't discuss specific instances here because the threads are private)?
This is a good start, but I would definitely expand this to ask about
security issues in specific, because that is the critical factor in
project governance.
At the other end of the lifecycle, the defining factor of "Should the
board force this dormant project into the Attic" is most often expressed
as "Does this PMC still have three PMC members who could respond to a
new security issue and push a release with a fix?"
We should also ensure that PPMCs are made aware of Security requirements
for TLPs, and how to handle vulnerabilities:
https://www.apache.org/security/committers.html
> I know this is a long winded question that really only expects a yes/no answer or something like:
> The PPMC has become less responsive recently. I will reach out to PPMC members to see if they can devote some more time to the private threads.
>
> The idea of the question is to act as a reminder of the importance of the private email threads.
True - along with a reminder about including private information in any
board reports (podling or TLP). A template answer here might be like
this, to show that including a public answer to the question is
important, but reminding people to use <private> markers for things that
should not be made public in minutes.
----
Yes, the PPMC has been regularly reviewing private@ threads for activity
lately.
<private>
The PPMC identified one incoming security report as invalid, and is
investigating a second security report to see if we need a CVE. (or
something like that)
</private>
----
> It would also be good if the shepherds also check the private threads when reviewing podling reports and report if they think there is a responsiveness issue.
--
- Shane
Member
The Apache Software Foundation
---------------------------------------------------------------------
To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
For additional commands, e-mail: general-help@incubator.apache.org