Hi,
I forgot the obvious: we should make an announcement not only on user ML but
also on announce@a.o
Struts is a good example: https://s.apache.org/qr8ci
They even have announceme...@struts.apache.org, not sure we need that.
I'll inspire from them to create our 1st announcement for EOL of the 18.12 branch with 17.12.08. Next time we will, like Struts, announce 6 months ago
before the definitive announcement.
I have created
Jacques
Le 04/01/2022 à 16:04, Jacques Le Roux a écrit :
Hi All,
I'd like to discuss about OFBiz releases EOL (End Of Life) announcement.
For instance R17.12 is EOL with 17.12.08. I suggest to make it clear on site (if that's not already enough, eg*), to send an email to user ML and
maybe talk about it in social-media and the blog.
Maybe we could also have a special site page for EOL dates and version of our
releases? And some words in https://ofbiz.apache.org/security.html...
* https://ofbiz.apache.org/release-notes-17.12.08.html (maybe the de facto
standard term EOL (End Of Life) is missing?)
Opinions?
Jacques
Le 04/01/2022 à 11:52, Jacques Le Roux a écrit :
I agree Jacopo,
Will you handle it?
I made those tiny changes after an answer Mark J. Cox made to Mark Thomas in a
discussion I read on security-disc...@community.apache.org :
MT: <<We need to consider whether projects that are not releasing
regularly really are healthy. Could they realistically respond to a
security vulnerability in a reasonable time frame? If not, we need to
move them to the attic.>>
MC: <<And we need a clear way to communicate that, and EOL releases, to
users so
they know the status of what they're using. There are quite a number of
examples where a project has responded to a vulnerability reporter that
some version is EOL but it's not been clear enough on their pages, nor any
real announcement ever having being made. We need a consistent policy on
what to do about vulnerabilities that come up in EOL versions, and when to
allocate them CVE names ('there's an unfixed issue in X") in order to help
users with scanning tools also notice when they're using out of date and
now insecure projects.>>
There are at least 340+ TLPs*. So I guess it becomes worrying for the ASF.
I don't think we are concerned by those worries. So was just a small effort in
this direction.
I think though that we should discuss about how to handle EOL announcements.
*
https://blogs.apache.org/foundation/entry/apache-software-foundation-security-report1
Jacques
Le 04/01/2022 à 10:45, Jacopo Cappellato a écrit :
Thank you Jacques for adding the statement: however I think it is > time to remove the entire section of 17.12.08 since we have enough > releases
out of 18.12 already. The release 17.12.08 will always be >
available in the archive. > > Jacopo
