1:37 p.m.
Hi,
first thank you for creating maillist. That's really useful.
Let me some qoute Eric and ask some questions.
As of 2014-06-10 there were 539 open security bugs in Fedora. With a
little work we should be able to get this number down by figuring out if the vulnerability
is still open, if a patch/release is available to fix it, or need to work upstream.
We'll likely need to come up with a way to categorize these things in BZ to make it
easier to do a search.
Can you provide link where I can get this list of bugs?
P.S. I did search RHBZ for CVEs, but don't know what product/component I want ;)
--
-Igor Gnatenko
3:11 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Wed, Jul 09, 2014 at 10:37:24PM +0400, Igor Gnatenko wrote:
first thank you for creating maillist. That's really useful.
Let me some qoute Eric and ask some questions.
> As of 2014-06-10 there were 539 open security bugs in Fedora. With a little work we
should be able to get this number down by figuring out if the vulnerability is still open,
if a patch/release is available to fix it, or need to work upstream. We'll likely
need to come up with a way to categorize these things in BZ to make it easier to do a
search.
Ahh, yes, my introduction to the mess that awaits us. :)
Can you provide link where I can get this list of bugs?
So, first, sorry for not immediately writing this message up when I subscribed you but
I'm a little crowded with a lot of little things around and I have the attention span
of... wait, what was I saying?
Oh right, bugs. Yes, so I'll tell you where they are and let you run them down. You
won't be able to search for them in a certain component as they are filed against the
packages themselves. If you search using the keywords "SecurityTracking"
you'll find them all. You should also be able to use the priority to comb through by
priority*. You can easily search for a subset of the bugs and come up with what
you're looking for like all the critical ones[0]. I'll go through and post links
on the wiki to make it easier for everyone to find.
So I see two tasks that need to really get going... now. First, we need to look at the
critical bugs and make sure they are being addressed. Second, we need to look at all the
unprioritized bugs and get them prioritized so we know where they are in the mix. The
priorities come from the CVEs that they block but you'll have to dig it out of the
whiteboard.
So we don't bump heads while working on things lets just send what you are working on
to the list so we'll all know who has what for now. Lets concentrate on the urgent
bugs and prioritizing. So if anyone wants to start working on 905373 just roger up for it
on the list and start working.
Thanks for everyone stepping up to help!
[0] http://red.ht/1lUHeBF
* This is not always the case. There was a bug in the tools that automatically generate
these bugs that failed to set the priority so we'll need to look at those. It's
really two bugs but it gets complicated. People know about it and are working on a fix.
- -- Eric
- --------------------------------------------------
Eric "Sparks" Christensen
Fedora Project
sparks(a)fedoraproject.org - sparks(a)redhat.com
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
- --------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQGcBAEBCgAGBQJTvaIKAAoJEB/kgVGp2CYvafAL/2qV/dAI5ifushA83Sw4byR6
Rk5953eR4Yy2xi+Z9lMvcrpAYkfom/cScbfw9v0oeyvzgh/amMMrC2h9V5HX5obB
wPzsf1FBiQl6VIB8v+vAuh3ihgj/2QvcMfVlfJLxgMKnbI8ZNirGGZTF1v8obtrD
S35qvLoPOrKUbPoixvQGsPMHMfT2h75PBEQ331bwaUnSzBoLPcK8tpXFq+9qQaTi
+3sqVnqEChmlkg7GzEAEeMTCgD6UXQJSPcflPcSizQBl4xROKvnF6pT6WuUZ38DE
+I4OSTqnHmWuXFvt6zqvlhlm/9hVefmoDIc25PWhAmQUYFsOL62fdHPLKUgq7Ohy
g2zp+PCiN8S6LdmRSA75SJXchsxUb0TnwKBQg2GhVRk36ol5kZBLVQrScfXVpVpO
N0CS7fhFMfecBCs3p6UFB7WbDbJM23P7v/lbC0u7bf3rUmK52nvg5s+7j6lUzB+0
psdQoDtR79Sez2PhEbiV1xWwA0tum4lII0Zg6I9fSw==
=+ije
-----END PGP SIGNATURE-----
4:26 p.m.
On Wednesday 09 July 2014 16:11:57 Eric H. Christensen wrote:
On Wed, Jul 09, 2014 at 10:37:24PM +0400, Igor Gnatenko wrote:
> first thank you for creating maillist. That's really useful.
> Let me some qoute Eric and ask some questions.
>
> > As of 2014-06-10 there were 539 open security bugs in Fedora. With a
> > little work we should be able to get this number down by figuring out
> > if the vulnerability is still open, if a patch/release is available to
> > fix it, or need to work upstream. We'll likely need to come up with a
> > way to categorize these things in BZ to make it easier to do a search.
Ahh, yes, my introduction to the mess that awaits us. :)
First of all: hello everybody!!! I am really glad that someone is taking the initiative
into getting some security in our distros and systems :-)
> Can you provide link where I can get this list of bugs?
So, first, sorry for not immediately writing this message up when I
subscribed you but I'm a little crowded with a lot of little things around
and I have the attention span of... wait, what was I saying?
Oh right, bugs. Yes, so I'll tell you where they are and let you run them
down. You won't be able to search for them in a certain component as they
are filed against the packages themselves. If you search using the
keywords "SecurityTracking" you'll find them all. You should also be able
to use the priority to comb through by priority*. You can easily search
for a subset of the bugs and come up with what you're looking for like all
the critical ones[0]. I'll go through and post links on the wiki to make
it easier for everyone to find.
In a few minutes search I could not find a way to come up with a search that gave
me such a number of open security bugs in Fedora. Would you mind sharing the
specific parameters you used to get such a result?
[OFFTOPIC]
Please please please, now that we are on a "security-team" list, do not use url
shorteners!!!! those things are only for limited characters environments like
Twitter or the like ;-)
[/OFFTOPIC]
So I see two tasks that need to really get going... now. First, we need to
look at the critical bugs and make sure they are being addressed. Second,
we need to look at all the unprioritized bugs and get them prioritized so
we know where they are in the mix. The priorities come from the CVEs that
they block but you'll have to dig it out of the whiteboard.
How do we make sure the bugs are being addressed? so far I only could see
ourselves as a team of people "bugging" the package maintainers to patch their
packages if they are involved in a CVE.
What can we *REALLY* do? (besides providing a patch for the code or the
package?)
Maybe in the future we get some recognition from the fedora community and we
have some voice/power...
So we don't bump heads while working on things lets just send what you are
working on to the list so we'll all know who has what for now. Lets
concentrate on the urgent bugs and prioritizing. So if anyone wants to
start working on 905373 just roger up for it on the list and start working.
I took the liberty of setting up an IRC Channel in irc.freenode.net: #fedora-
security-team
Feel free to drop by and we can discuss things real time! :-)
Thanks for everyone stepping up to help!
Thanks you for taking the time to organize everything!
[0] http://red.ht/1lUHeBF
* This is not always the case. There was a bug in the tools that
automatically generate these bugs that failed to set the priority so we'll
need to look at those. It's really two bugs but it gets complicated.
People know about it and are working on a fix.
-- Eric
--------------------------------------------------
Eric "Sparks" Christensen
Fedora Project
sparks(a)fedoraproject.org - sparks(a)redhat.com
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
--------------------------------------------------
_______________________________________________
security-team mailing list
security-team(a)lists.fedoraproject.org
https://lists.fedoraproject.org/mailman/listinfo/security-team
--
Marc Deop[1]
*System Engineer*
--------
[1] mailto:marc@marcdeop.com
12:44 p.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Wed, Jul 09, 2014 at 11:26:36PM +0200, Marc Deop Argemí wrote:
On Wednesday 09 July 2014 16:11:57 Eric H. Christensen wrote:
> On Wed, Jul 09, 2014 at 10:37:24PM +0400, Igor Gnatenko wrote:
> > Can you provide link where I can get this list of bugs?
>
> So, first, sorry for not immediately writing this message up when I
> subscribed you but I'm a little crowded with a lot of little things around
> and I have the attention span of... wait, what was I saying?
>
> Oh right, bugs. Yes, so I'll tell you where they are and let you run them
> down. You won't be able to search for them in a certain component as they
> are filed against the packages themselves. If you search using the
> keywords "SecurityTracking" you'll find them all. You should also be
able
> to use the priority to comb through by priority*. You can easily search
> for a subset of the bugs and come up with what you're looking for like all
> the critical ones[0]. I'll go through and post links on the wiki to make
> it easier for everyone to find.
In a few minutes search I could not find a way to come up with a search that gave
me such a number of open security bugs in Fedora. Would you mind sharing the
specific parameters you used to get such a result?
Product: Fedora
Keywords: SecurityTracking
Priority: urgent (this will get you the most critical security bugs)
You can leave Priority blank and get all of the bugs but that will be a mess.
[OFFTOPIC]
Please please please, now that we are on a "security-team" list, do not use url
shorteners!!!! those things are only for limited characters environments like
Twitter or the like ;-)
[/OFFTOPIC]
No, they aren't just for limited character environments. I'd much prefer see the
short url in an email than:
https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASS...
That said, these links will be placed on a wiki page so they are easier to get to. Bug
URLs aren't as long and messy as the above and shouldn't need to be shortened.
> So I see two tasks that need to really get going... now. First,
we need to
> look at the critical bugs and make sure they are being addressed. Second,
> we need to look at all the unprioritized bugs and get them prioritized so
> we know where they are in the mix. The priorities come from the CVEs that
> they block but you'll have to dig it out of the whiteboard.
How do we make sure the bugs are being addressed? so far I only could see
ourselves as a team of people "bugging" the package maintainers to patch their
packages if they are involved in a CVE.
What can we *REALLY* do? (besides providing a patch for the code or the
package?)
Maybe in the future we get some recognition from the fedora community and we
have some voice/power...
And that's what this experiment is all about. We really don't need to *bug*
people about this stuff but rather do the work if they won't.
If a security bug comes up and the packager doesn't seem involved then we need to go
upstream and see if there is a fix. If upstream has a fix then we need to make sure the
packager knows that the fix is available and that it needs to get shipped. If upstream
isn't aware we need to open a ticket upstream and link it with our ticket. Once we
have a fix and the packager(s) seem unwilling to take action we need to go to FESCo and
ask for them to take action. I'm assuming it will be rare to have to go to such
measures as to go to FESCo.
> So we don't bump heads while working on things lets just
send what you are
> working on to the list so we'll all know who has what for now. Lets
> concentrate on the urgent bugs and prioritizing. So if anyone wants to
> start working on 905373 just roger up for it on the list and start working.
I took the liberty of setting up an IRC Channel in irc.freenode.net: #fedora-
security-team
Yeah, I thought about using #fedora-security but, like the security list, it seems to be
more end-user questions/advice than actual work. I'll join up now.
- --Eric
- --------------------------------------------------
Eric "Sparks" Christensen
Red Hat, Inc - Product Security
sparks(a)redhat.com - sparks(a)fedoraproject.org
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
- --------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQGcBAEBCgAGBQJTvtEQAAoJEB/kgVGp2CYvCEAL/RZpMQnKTvOoSwYk+gLjYo1c
lCuVWWSm1slv8wzxzrOJPcnM73iwI2hKknua9KpG0WVIYJS92tv8d2RMvhTkBc+0
cBbeXX3j69mhD+dft+4XvOwMEE+mHYFj9jiCYKL17GX/WFhc5Stx3Rbb4iwib7rx
l8p5qeQGAeZPN9m7Kly3wLp5OJVueiyzLR2TC9aaSAWd0+eWE5kSpkQ1dkJzDV73
JBmytwDaZKZ8MzPZIgcp7MWf863xi5FfACkd3XmYfe/LSaUL2awSAhqLg04k7Nyk
cJ0vWMZ/bRgYTtpSukzkVHGYfeXTAecabv5+DBNtMjF/ShRrEBldjG2EFihOhJDc
mfC6Z2TH2aSLX7/OG0xS3AE5oq2Ge8GPPg5dHPOT7dPoBp3ZMII56MbJDO4kP4hJ
pwO1wo/5+iuehQma4goCcolmNRPCsXoMZmilsvi1dm0zmiDZSMBSp6Yhw0cvFA6F
XBa6OopGUiPVTHIXoaciZIuu4c655tTP69tpcwhR+g==
=BfQl
-----END PGP SIGNATURE-----
12:13 a.m.
Am I searching properly if I end up showing 47 Urgent bugs for Fedora?
Note: I had to use the "Browse" (beta) function before a Priority option
showed up. It wasn't there under the simple or advanced search tabs.
- Tim
On Thu, Jul 10, 2014 at 1:44 PM, Eric H. Christensen <
sparks(a)fedoraproject.org> wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Wed, Jul 09, 2014 at 11:26:36PM +0200, Marc Deop Argemí wrote:
> On Wednesday 09 July 2014 16:11:57 Eric H. Christensen wrote:
> > On Wed, Jul 09, 2014 at 10:37:24PM +0400, Igor Gnatenko wrote:
> > > Can you provide link where I can get this list of bugs?
> >
> > So, first, sorry for not immediately writing this message up when I
> > subscribed you but I'm a little crowded with a lot of little things
around
> > and I have the attention span of... wait, what was I saying?
> >
> > Oh right, bugs. Yes, so I'll tell you where they are and let you run
them
> > down. You won't be able to search for them in a certain component as
they
> > are filed against the packages themselves. If you search using the
> > keywords "SecurityTracking" you'll find them all. You should
also be
able
> > to use the priority to comb through by priority*. You can easily
search
> > for a subset of the bugs and come up with what you're looking for like
all
> > the critical ones[0]. I'll go through and post links on the wiki to
make
> > it easier for everyone to find.
>
> In a few minutes search I could not find a way to come up with a search
that gave
> me such a number of open security bugs in Fedora. Would you mind
sharing the
> specific parameters you used to get such a result?
Product: Fedora
Keywords: SecurityTracking
Priority: urgent (this will get you the most critical security bugs)
You can leave Priority blank and get all of the bugs but that will be a
mess.
> [OFFTOPIC]
> Please please please, now that we are on a "security-team" list, do not
use url
> shorteners!!!! those things are only for limited characters environments
like
> Twitter or the like ;-)
> [/OFFTOPIC]
No, they aren't just for limited character environments. I'd much prefer
see the short url in an email than:
https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW&bug_status=ASS...
That said, these links will be placed on a wiki page so they are easier to
get to. Bug URLs aren't as long and messy as the above and shouldn't need
to be shortened.
> > So I see two tasks that need to really get going... now. First, we
need to
> > look at the critical bugs and make sure they are being addressed.
Second,
> > we need to look at all the unprioritized bugs and get them prioritized
so
> > we know where they are in the mix. The priorities come from the CVEs
that
> > they block but you'll have to dig it out of the whiteboard.
>
> How do we make sure the bugs are being addressed? so far I only could see
> ourselves as a team of people "bugging" the package maintainers to patch
their
> packages if they are involved in a CVE.
>
> What can we *REALLY* do? (besides providing a patch for the code or the
> package?)
>
> Maybe in the future we get some recognition from the fedora community
and we
> have some voice/power...
And that's what this experiment is all about. We really don't need to
*bug* people about this stuff but rather do the work if they won't.
If a security bug comes up and the packager doesn't seem involved then we
need to go upstream and see if there is a fix. If upstream has a fix then
we need to make sure the packager knows that the fix is available and that
it needs to get shipped. If upstream isn't aware we need to open a ticket
upstream and link it with our ticket. Once we have a fix and the
packager(s) seem unwilling to take action we need to go to FESCo and ask
for them to take action. I'm assuming it will be rare to have to go to
such measures as to go to FESCo.
> > So we don't bump heads while working on things lets just send what you
are
> > working on to the list so we'll all know who has what for now. Lets
> > concentrate on the urgent bugs and prioritizing. So if anyone wants to
> > start working on 905373 just roger up for it on the list and start
working.
>
> I took the liberty of setting up an IRC Channel in irc.freenode.net:
#fedora-
> security-team
Yeah, I thought about using #fedora-security but, like the security list,
it seems to be more end-user questions/advice than actual work. I'll join
up now.
- --Eric
- --------------------------------------------------
Eric "Sparks" Christensen
Red Hat, Inc - Product Security
sparks(a)redhat.com - sparks(a)fedoraproject.org
097C 82C3 52DF C64A 50C2 E3A3 8076 ABDE 024B B3D1
- --------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQGcBAEBCgAGBQJTvtEQAAoJEB/kgVGp2CYvCEAL/RZpMQnKTvOoSwYk+gLjYo1c
lCuVWWSm1slv8wzxzrOJPcnM73iwI2hKknua9KpG0WVIYJS92tv8d2RMvhTkBc+0
cBbeXX3j69mhD+dft+4XvOwMEE+mHYFj9jiCYKL17GX/WFhc5Stx3Rbb4iwib7rx
l8p5qeQGAeZPN9m7Kly3wLp5OJVueiyzLR2TC9aaSAWd0+eWE5kSpkQ1dkJzDV73
JBmytwDaZKZ8MzPZIgcp7MWf863xi5FfACkd3XmYfe/LSaUL2awSAhqLg04k7Nyk
cJ0vWMZ/bRgYTtpSukzkVHGYfeXTAecabv5+DBNtMjF/ShRrEBldjG2EFihOhJDc
mfC6Z2TH2aSLX7/OG0xS3AE5oq2Ge8GPPg5dHPOT7dPoBp3ZMII56MbJDO4kP4hJ
pwO1wo/5+iuehQma4goCcolmNRPCsXoMZmilsvi1dm0zmiDZSMBSp6Yhw0cvFA6F
XBa6OopGUiPVTHIXoaciZIuu4c655tTP69tpcwhR+g==
=BfQl
-----END PGP SIGNATURE-----
_______________________________________________
security-team mailing list
security-team(a)lists.fedoraproject.org
https://lists.fedoraproject.org/mailman/listinfo/security-team
7:46 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Tue, Jul 15, 2014 at 01:13:03AM -0400, joat wrote:
Am I searching properly if I end up showing 47 Urgent bugs for
Fedora?
Note: I had to use the "Browse" (beta) function before a Priority option
showed up. It wasn't there under the simple or advanced search tabs.
I think there should be more. I'll work on the wiki pages today and get the links
posted.
- --Eric
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQGcBAEBCgAGBQJTxSK4AAoJEB/kgVGp2CYvJuwL/Rmj4JSaWhPURfXwHNiikr2S
qZBQRHkCRUKaVJ1flQVhPqOu8M9qVnV72NpJrMLTtCtxrIsGFO9RseRLRt6GSDjT
5kapng5Kh2z6FK3N/lIqEtXfLprFt6WuLv7+EpK1ZWHJ49aPT2bm8QwCqaiGy48a
JbYvjd+VemlgksbdxzHY4gN1ewNpdjjhmvc5wVu03sHDHNNdFoRAQ74pQUmp++ek
LA9Q9POrRSOsyCwmnUPmLxn0CMnTHQJOVXJPLqZyWCgLiBb3lGDZ05k/+VSfJe/y
+aKKjajtEjU2YvOjz6dF/kqu8EV+N0/0b40OUWcSq9eGpSu0zLvTnKyU9W8IlskJ
2a4f2aiCxj1Ykit6Pw7f0/+/KsNvt1/eUr4IpDJdsbvDljcPfux8RIOk+UmgtVE1
3+nZ37GSPMEDWrRWrHhDRN+U6UyQUDY7O3akWVm9d4x3Y2Yq/5Zx4T8MI/RiSimU
tbQ+xViVK6azYciHf8ZV6tp0+2Xj4q+C60twC8Eisw==
=U9M5
-----END PGP SIGNATURE-----
7:52 a.m.
Thanks Eric!
Francisco Alonso / Red Hat Product Security
PGP: 0xA026440E 0825 020C 7A5A 4F86 9038 B1C8 5562 688F A026 440E
----- Original Message -----
From: "Eric H. Christensen"
<sparks(a)fedoraproject.org>
To: "Fedora Security Team" <security-team(a)lists.fedoraproject.org>
Sent: Tuesday, July 15, 2014 2:46:51 PM
Subject: Re: First message in list with some questions ;)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
On Tue, Jul 15, 2014 at 01:13:03AM -0400, joat wrote:
> Am I searching properly if I end up showing 47 Urgent bugs for Fedora?
> Note: I had to use the "Browse" (beta) function before a Priority option
> showed up. It wasn't there under the simple or advanced search tabs.
I think there should be more. I'll work on the wiki pages today and get the
links posted.
- --Eric
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQGcBAEBCgAGBQJTxSK4AAoJEB/kgVGp2CYvJuwL/Rmj4JSaWhPURfXwHNiikr2S
qZBQRHkCRUKaVJ1flQVhPqOu8M9qVnV72NpJrMLTtCtxrIsGFO9RseRLRt6GSDjT
5kapng5Kh2z6FK3N/lIqEtXfLprFt6WuLv7+EpK1ZWHJ49aPT2bm8QwCqaiGy48a
JbYvjd+VemlgksbdxzHY4gN1ewNpdjjhmvc5wVu03sHDHNNdFoRAQ74pQUmp++ek
LA9Q9POrRSOsyCwmnUPmLxn0CMnTHQJOVXJPLqZyWCgLiBb3lGDZ05k/+VSfJe/y
+aKKjajtEjU2YvOjz6dF/kqu8EV+N0/0b40OUWcSq9eGpSu0zLvTnKyU9W8IlskJ
2a4f2aiCxj1Ykit6Pw7f0/+/KsNvt1/eUr4IpDJdsbvDljcPfux8RIOk+UmgtVE1
3+nZ37GSPMEDWrRWrHhDRN+U6UyQUDY7O3akWVm9d4x3Y2Yq/5Zx4T8MI/RiSimU
tbQ+xViVK6azYciHf8ZV6tp0+2Xj4q+C60twC8Eisw==
=U9M5
-----END PGP SIGNATURE-----
_______________________________________________
security-team mailing list
security-team(a)lists.fedoraproject.org
https://lists.fedoraproject.org/mailman/listinfo/security-team
3572
days inactive
3578
days old
security-team@lists.fedoraproject.org
6 comments
5 participants
participants (5)
-
Eric Christensen -
Francisco Alonso -
Igor Gnatenko -
joat -
Marc Deop Argemí