From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 5B01DD80CAA for ; Wed, 24 Jan 2024 17:05:42 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=XxECraTSIe/pbAvWd9FdjXJ1himv2qew60Md6/LD1YY=; c=relaxed/simple; d=groups.io; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:In-Reply-To:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Type:Content-Disposition; s=20140610; t=1706115941; v=1; b=kKlUyS2lvU6foJLB6ema/8fcbeICp1LJpYwJvOiQJgsTYhJF1l73oDwEM4lcfa4Zs1rbuoSB ZAObtMhf7rKhD5Rez5SSf7Sd3Jg5Y7+TbV9FKakpORQC60PGrIP5P+efjoXbHNbiH0KR4XXQ/gH c4tTqAB93ER/zfUFb0N+1yF0= X-Received: by 127.0.0.2 with SMTP id lnVAYY7687511xpFJwWhWl5v; Wed, 24 Jan 2024 09:05:41 -0800 X-Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by mx.groups.io with SMTP id smtpd.web10.28428.1706115940346811786 for ; Wed, 24 Jan 2024 09:05:40 -0800 X-Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-348-pCtNR1PWMNC0UR2jP_7FvA-1; Wed, 24 Jan 2024 12:05:38 -0500 X-MC-Unique: pCtNR1PWMNC0UR2jP_7FvA-1 X-Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.rdu2.redhat.com [10.11.54.6]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id C90B53816B40; Wed, 24 Jan 2024 17:05:37 +0000 (UTC) X-Received: from sirius.home.kraxel.org (unknown [10.39.193.66]) by smtp.corp.redhat.com (Postfix) with ESMTPS id A52CC2166B32; Wed, 24 Jan 2024 17:05:37 +0000 (UTC) X-Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id AB9DA180038B; Wed, 24 Jan 2024 18:05:36 +0100 (CET) Date: Wed, 24 Jan 2024 18:05:36 +0100 From: "Gerd Hoffmann" To: Vincent Zimmer Cc: devel@edk2.groups.io, lersek@redhat.com, dougflick@microsoft.com, Jon Maloy Subject: Re: [edk2-devel] pixiefail Message-ID: References: MIME-Version: 1.0 In-Reply-To: X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.6 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,kraxel@redhat.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: Gl3KzOauH2FLtnZX56xi7zFOx7686176AA= Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=kKlUyS2l; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=redhat.com (policy=none) On Wed, Jan 24, 2024 at 07:20:34AM -0800, Vincent Zimmer wrote: > I agree on your sentiment about Bugzilla (bz) not being ideal for this. > This space has been a multi-year journey from usrt-based tickets, bespoke > advisories, bz, etc into today's world of tianocore infosec, tianocore as > its own CVE Naming Authority (CNA) and working to leverage the extant > features of github. On that latter point, there is work afoot to evolve > from the present bz-based process > https://github.com/tianocore/tianocore.github.io/wiki/Reporting-Security-Issues > to a github-based one > https://github.com/tianocore/tianocore.github.io/wiki/GHSA-GitHub-Security-Advisories-Proceess-(Draft). > Things are in transition now and I'd echo Doug's sentiment that getting > more feedback and engagement from the community would be valuable in > getting the various parts tested, evolved, documented, reviewed, etc. The GHSA process certainly is an improvement over using patches attached to bugzilla. There still is room for improvement though. Community engagement is a problem indeed, and my overall impression is that it is even worse than on the edk2 devel list. I think part of the problem might be lack of notifications. I can't remember being notified in case the "tianocore infosec team" group is added to a new GHSA, so it's hard to learn about new advisories ... take care, Gerd -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#114332): https://edk2.groups.io/g/devel/message/114332 Mute This Topic: https://groups.io/mt/103913088/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-