incubator-ooo-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Dennis E. Hamilton" <dennis.hamil...@acm.org>
Subject RE: [DISCUSS] Neutral / shared security list proposal
Date Fri, 21 Oct 2011 18:27:40 GMT
OK, I am going ahead and including securityteam@OO.o in this discussion, then all of us can
see what's being discussed.

I am adding the full text of what Michael was replying to as well.

Simon proposes something more promising, from my viewpoint, beyond bilateral ownership between
AOOo and TDF.  He is looking for a multilateral solution using securityteam@ OO.o, and this
[DISCUSS] was started in response to Simon's proposal.

There have been objections to this being only bilateral between AOOo and TDF.  A multilateral
approach is preferred for how the list conducts itself and how participants are able to ensure
coordination with their own private security operations when an issue of common concern comes
to light.

Securityteam@ OO.o has a multilateral membership, I presume.  That was workable under Sun
and OASIS custodianship and there is no reason to assume that ASF (not AOOo) is not a reliable
custodian in that regard with regard to operational support, preserving security of the list,
dealing with outages, etc.  This is not about what happens on the list, but fundamental IT
operational support and the serious desire to ensure security and preservation for the list
and its archives.  ASF (not AOOo) has strong, enduring capabilities in that regard.  It also
manages an overall security@ operation and supports the various security teams associated
with individual Apache projects.

Since ASF has been granted the domain name, the continuation of securityteam@ OO.o will come
under ASF infrastructure operation at some point, in some manner.  If the list can be preserved
using the already-known list address, that will be the least disruptive, operationally.

How governance is dealt with on the list is independent of custodianship and has to be worked
out whoever hosts the list.  Commitment to multilateral governance is not a JFDI.

 - Dennis



-----Original Message-----
From: Marc-André Laverdière [mailto:marc-andre@atc.tcs.com] 
Sent: Friday, October 21, 2011 10:51
To: orcmid@apache.org
Cc: ooo-dev@incubator.apache.org; michael.meeks@suse.com; 'lsecurity'; 'Simon Phipps'
Subject: RE: [DISCUSS] Neutral / shared security list proposal

I tend to go for the "just get it done" philosophy when we reach that point.

So let me summarize what that'd mean for me:

- Michael registers us a neutral mailing list and both teams register 3-4
folks
- We stick with the 'old' ml with the suggested membership structure.

Like, seriously... just get it done ;)

> Excuse me Michael, the proposal I am referring to was offered by Simon
> Phipps
> and I included his message.
>
> If you don't want to accept the OUTLINE PROPOSAL or start from it as a
> point
> of discussion, that is fine.  Just be clear that Simon's proposal was the
> one
> that I was replying about and proposing be [DISCUSS]ed on ooo-dev too.
>
> I was hoping that Simon's good offices in mediating this would be
> valuable.
> Is that not acceptable?
>
> What I like about Simon's proposal is that it is the least disruptive, and
> it
> adds meritocracy and (private) transparency features to how
> securityteam@OO.o
> operates.  I assume that the current securityteam@ OO.o list would be
> grandfathered in.  Why not?
>
> I pointed out in starting this [DISCUSS] thread that there is enough
> connection from ooo-security so that ASF can be represented well enough in
> discussion on securityteam@ OO.o to forward Simon's proposal, if there is
> agreement to do that.  I don't see where anything about myself, Rob, and
> Caolan are in the message you are responding to.
>
> With regard to how the list software works/might-not/doesn't, can these 2d
> and
> 3rd order issues be deferred until the big questions are handled?
>
>  - Dennis
>
> -----Original Message-----
> From: Michael Meeks [mailto:michael.meeks@suse.com]
> Sent: Friday, October 21, 2011 10:07
> To: orcmid@apache.org
> Cc: 'Simon Phipps'; ooo-dev@incubator.apache.org; lsecurity
> Subject: Re: [DISCUSS] Neutral / shared security list proposal
>
> Hi Dennis & list,
>
> On Fri, 2011-10-21 at 08:11 -0700, Dennis E. Hamilton wrote:
>> It is not something that can be done unilaterally here on the AOOo
>> podling.
>> Do you propose that this be discussed at securityteam@ OO.o?  It would
>> seem that is where consensus is required.
>
> 	Last I checked only a few from TDF's security group are on that list;
> so it doesn't seem an ideal forum either. Lets just CC our security team
> as I've done.
>
> 	I am mildly amused by the convenient deployment of the argument type:
> "we have always done it this way" from a project undergoing such a lot
> of (in many ways positive) changes. Combine this with a world of
> extraordinary possibilities such as: mail forwarding and the "mail
> address is well known" bites the dust. There were many projects and
> people I used to admire in the ASF, but claiming it is neutral in
> today's world is not sensible.
>
> 	I would like to see, and think it is reasonable to ask for:
>
> 	1. a neutral domain / list name
> 	2. a comprehensive set of moderators / admins cf. previous
> 	3. neutral hosting
>
> 	It seems vs. the present that the ASF guys are suggesting to compromise
> on only one of these points (2.) ie. having two Apache supporters (Rob +
> Dennis) as moderators, and one TDF guy (me or Caolan): is that right ?
>
> 	At a big stretch, assuming there is no heavy-governance-petting
> anywhere near it, I could cope with not having 3. ie. Apache hosting it
> - after all, that is rather invisible [ but I personally loathe reply-to
> mangling - I don't believe we would want that pushed onto us ].
>
> 	So - where do we go from there ? it looks to me like no compromise is
> possible (for some definitions of compromise). We could create two
> 'neutral' mailing lists one at each side, with cross subscriptions to
> our own security lists - but it all seems a bit pointless.
>
> 	Regards,
>
> 		Michael.
>
> --
> michael.meeks@suse.com  <><, Pseudo Engineer, itinerant idiot
>

-----Original Message-----
From: Dennis E. Hamilton [mailto:orcmid@apache.org] 
Sent: Friday, October 21, 2011 08:11
To: 'Simon Phipps'
Cc: 'Michael Meeks'; ooo-dev@incubator.apache.org
Subject: [DISCUSS] Neutral / shared security list proposal

I'm not sure Simon noticed this.  Here's a follow-up, with a fresh thread.

Simon, what is the next action on this proposal?  It is not something that can 
be done unilaterally here on the AOOo podling.  Do you propose that this be 
discussed at securityteam@ OO.o?  It would seem that is where consensus is 
required.

AOOo ooo-security follows that list, as I described previously.  And there 
appear to be at least three of us from the AOOo PPMC that are individually 
subscribed.  So AOOo representation in the discussion can be assured.

What's next?

 - Dennis E. Hamilton
   tools for document interoperability,  <http://nfoWorks.org/>
   dennis.hamilton@acm.org  gsm: +1-206-779-9430  @orcmid

-----Original Message-----
From: Dennis E. Hamilton [mailto:dennis.hamilton@acm.org]
Sent: Wednesday, October 19, 2011 17:51
To: ooo-dev@incubator.apache.org; orcmid@apache.org
Cc: 'Michael Meeks'
Subject: RE: Neutral / shared security list ...

OK Simon, but I am talking about custodial responsibility too, not just the 
manner in which list administration and moderation are handled.

I personally have no objection to the governance you propose in your second 
and third bullets.  I have no idea how it is done right now, since I am new to 
that list.  However ooo-security has been receiving mail from that list since 
2011-10-13 and I have not seen any governance discussions, nor any indication 
of additions to the list in any way.

It seems to me that your proposal should go to securityteam@ as well [;<).  I 
assume there are enough individuals there that are empowered to hammer this 
out.

In that case, any intervention from ASF security@ observers of securityteam@ 
would be if the house was on fire and from Apache Infra if the list was seen 
to be hacked or anything required immediate intervention, such as shutting 
down and restoring the list, anything else appropriate.  These are operational 
responsibilities that require someone with IT-operations level access to the 
equipment.

Does that work better for you?

 - Dennis

-----Original Message-----
From: Simon Phipps [mailto:simon@webmink.com]
Sent: Wednesday, October 19, 2011 16:19
To: ooo-dev@incubator.apache.org; orcmid@apache.org
Cc: Michael Meeks
Subject: Re: Neutral / shared security list ...

On Wed, Oct 19, 2011 at 10:56 PM, Dennis E. Hamilton <orcmid@apache.org>wrote:

If securityteam@ OO.o is preserved, I believe the oversight of security@
> apache.org and the care of Apache infrastructure is a bonus.


I disagree. Having an arbitrary steward - regardless of their excellence -
is not the way to sustain (or indeed rebuild) trust. The correct oversight
is the list-members themselves.


OUTLINE PROPOSAL:

Thus I'd propose (in outline):

*  That securityteam@openoffice.org be used as the shared meta-community
security contact list for projects deriving their source code from the
former Sun-led OpenOffice.org project. The list would be used for any valid
meta-community security matter including especially announcement
co-ordination.

* That the list should be private to list members (and with the consent of
the list, to their project's private security list), with mutually agreed
confidentiality, and populated only with people known to the majority of the
list members as bona-fides security-related developers.

*  That the list be populated only with the consent of the existing list
members (suggested process: a list member proposes a new list member with a
brief explanation why they are a good-faith and experienced security
developer in the meta-community. Code-modification-style voting takes place.
A moderator adds the new member. In the event of mishap, list members may be
removed using the same process).

*  Agreeing who the moderators should be by list-member consensus

I'm sure this needs fleshing out by someone more process oriented, but I
suggest this outline represents a workable compromise.

Regards

S.


Mime
View raw message