Pete Wright wrote:
hello - i was hoping to find the best place to help address outstanding CVE's for python pkgs. i noticed charlie's last comment in this bug:
tl;dr the best balance is allowing upstream and python@ to do their jobs.
i understand that it is a lot of effort to keep on top of these patches. since i run python systems for work i would like to do my fair share to help get these patched in a timely manner. my goal would be to have "pkg audit" be clean for my python webapp servers.The other, bigger, issue that I did not elaborate further on there, because it is not entirely relevant to that PR, deals with how broken the CVE system, and by extension vuxml, is. The more recent vuxml entries were not added or validated by the python@ team, and the timing in which they were added did not correspond to upstream having cut releases addressing them. Some of those entries, particularly the one concerning IMAP, upstream still needs to work through not regressing previously correct behaviour amongst other things.
The better way to do vuxml is what many other committers already do with other ports: add the entries *after* a release or other off-cycle commit(s) addressing the entries are ready for use. Adding entries that upstream do not have mitigations for does not benefit anyone (apart from some kind of vanity).
Apparently the word "security" and the want for clean `pkg audit`s evokes some sort of emotional response to the point of bullying and subverting maintainers to re-prioritise existing work and processes, which already include dealing with security issues. We all want clean `pkg audit`s at the end of the day, but a big part of security is actually reviewing entries on your own and comparing them to *your* threat model rather than blindly reacting.
i searched bugzilla and wasn't sure if we are filing reports for each CVE and tracking there, or are our efforts better spent focusing on getting a newer default python out the door?Please do not do anything of this sort, they only slow things down. Security reports almost always affect every supported and development branch upstream at the same time.
-- Charlie Li ...nope, still don't have an exit line.
OpenPGP_signature.asc
Description: OpenPGP digital signature
