security-discuss  

Messages by Thread

• Using Github Actions Trusted Publisher for PyPI releases ? Jarek Potiuk
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Mark Thomas
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Jarek Potiuk
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Jarek Potiuk
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Gary Gregory
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Jarek Potiuk
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Piotr P. Karwasz
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Jarek Potiuk
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Greg Stein
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Jarek Potiuk
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Jarek Potiuk
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Dave Fisher
  • Re: Using Github Actions Trusted Publisher for PyPI releases ? Jarek Potiuk
• Pixee AI Mike Drob
  • Re: Pixee AI Roman Shaposhnik
• Re: Siren by OpenSSF Arnout Engelen
  • Re: Siren by OpenSSF Jarek Potiuk
• Re: Vulnerability found in your website ! Apache Security Team
• Re: Package URLs for Apache Tomcat distributions von Loewenstein, Jan
  • Re: Package URLs for Apache Tomcat distributions Piotr P. Karwasz
  • Re: Package URLs for Apache Tomcat distributions Arnout Engelen
  • Re: Package URLs for Apache Tomcat distributions Lars Francke
  • Re: Package URLs for Apache Tomcat distributions von Loewenstein, Jan
• Fwd: Board report for this month (draft) Dirk-Willem van Gulik
• XZ, covert actions, Industry limits - drugs-smuggling Dirk-Willem van Gulik
• Binary blobs in source trees Mike Drob
  • Re: Binary blobs in source trees Gary Gregory
  • Re: Binary blobs in source trees Nick Wellnhofer
  • Re: Binary blobs in source trees Dominik Psenner
  • Re: Binary blobs in source trees Dirk-Willem van Gulik
  • Re: Binary blobs in source trees Gary Gregory
  • Re: Binary blobs in source trees Graham Leggett
  • Re: Binary blobs in source trees Dirk-Willem van Gulik
  • Re: Binary blobs in source trees Emmanuel Lécharny
  • Re: Binary blobs in source trees Jarek Potiuk
  • Re: Binary blobs in source trees Gary Gregory
  • Re: Binary blobs in source trees Stefan Bodewig
  • Re: Binary blobs in source trees Emmanuel Lécharny
  • Re: Binary blobs in source trees Stefan Bodewig
  • Re: Binary blobs in source trees giovanni
  • Re: Binary blobs in source trees Graham Leggett
  • Re: Binary blobs in source trees Stefan Bodewig
  • Re: Binary blobs in source trees Brian Demers
• [DISCUSS] Should we update our policies to include source provenance check Jarek Potiuk
  • Re: [DISCUSS] Should we update our policies to include source provenance check sebb
  • Re: [DISCUSS] Should we update our policies to include source provenance check Jarek Potiuk
  • AW: [DISCUSS] Should we update our policies to include source provenance check Christofer Dutz
  • Re: [DISCUSS] Should we update our policies to include source provenance check sebb
  • Re: [DISCUSS] Should we update our policies to include source provenance check Mark Thomas
  • Re: [DISCUSS] Should we update our policies to include source provenance check sebb
  • Re: [DISCUSS] Should we update our policies to include source provenance check Jarek Potiuk
  • Re: [DISCUSS] Should we update our policies to include source provenance check Philippe Ombredanne
  • Re: [DISCUSS] Should we update our policies to include source provenance check Piotr P. Karwasz
• Snyk, Sonartype, etc Dirk-Willem van Gulik
  • Re: Snyk, Sonartype, etc sebb
  • Re: Snyk, Sonartype, etc Mike Drob
  • Re: Snyk, Sonartype, etc Willem Jiang
• Acceptability of Third-Party Password Manager Bryan Ellis
  • Re: Acceptability of Third-Party Password Manager Bill Cole
  • Re: Acceptability of Third-Party Password Manager Jarek Potiuk
• Enabling security autofix suggestion ? Jarek Potiuk
  • Re: Enabling security autofix suggestion ? Jacques Le Roux
  • Re: Enabling security autofix suggestion ? Gary Gregory
  • Re: Enabling security autofix suggestion ? Piotr P. Karwasz
  • Re: Enabling security autofix suggestion ? Jarek Potiuk
• Apache SBOM tracking in DependencyTrack Arnout Engelen
  • Re: Apache SBOM tracking in DependencyTrack Andrea Cosentino
  • Re: Apache SBOM tracking in DependencyTrack Gary Gregory
  • Re: Apache SBOM tracking in DependencyTrack Lars Francke
  • Re: Apache SBOM tracking in DependencyTrack Gary Gregory
  • Re: Apache SBOM tracking in DependencyTrack Lars Francke
  • Re: Apache SBOM tracking in DependencyTrack Gary Gregory
  • Re: Apache SBOM tracking in DependencyTrack Arnout Engelen
  • Re: Apache SBOM tracking in DependencyTrack Piotr P. Karwasz
  • Re: Apache SBOM tracking in DependencyTrack Gary Gregory
  • Re: Apache SBOM tracking in DependencyTrack Lars Francke
  • Re: Apache SBOM tracking in DependencyTrack Gary Gregory
  • Re: Apache SBOM tracking in DependencyTrack Lars Francke
  • Re: Apache SBOM tracking in DependencyTrack Jarek Potiuk
  • Re: Apache SBOM tracking in DependencyTrack Lars Francke
  • Re: Apache SBOM tracking in DependencyTrack Jarek Potiuk
  • Re: Apache SBOM tracking in DependencyTrack Piotr P. Karwasz
  • Re: Apache SBOM tracking in DependencyTrack Arnout Engelen
• Proposed PyPI digital attestation PEP Jarek Potiuk
• approving basic security headers for POI web site PJ Fanning
• Reproducible builds [Airflow] -> done Jarek Potiuk
  • Re: Reproducible builds [Airflow] -> done Gary Gregory
  • AW: Reproducible builds [Airflow] -> done Christofer Dutz
  • Re: Reproducible builds [Airflow] -> done Piotr P. Karwasz
  • Re: Reproducible builds [Airflow] -> done Jarek Potiuk
• 2023 annual report published Mark J Cox
• CVE-2023-49735 in Apache Tiles Sebastian Götz
  • Re: CVE-2023-49735 in Apache Tiles Arnout Engelen
• Security track at CoC? Mike Drob
  • Re: Security track at CoC? Brian Demers
  • Re: Security track at CoC? Jarek Potiuk
  • Re: Security track at CoC? Matt Sicker
  • Re: Security track at CoC? Mike Drob
• Platypus attack on Docker affecting a number of our projects potentially? Jarek Potiuk
• How to approach the problem of "3rd-party CVE dependencies impact" Jarek Potiuk
  • Re: How to approach the problem of "3rd-party CVE dependencies impact" Lars Francke
  • Re: How to approach the problem of "3rd-party CVE dependencies impact" Joe Witt
  • Re: How to approach the problem of "3rd-party CVE dependencies impact" Lars Francke
  • Re: How to approach the problem of "3rd-party CVE dependencies impact" Jude Smith
  • Re: How to approach the problem of "3rd-party CVE dependencies impact" Jarek Potiuk
  • Re: How to approach the problem of "3rd-party CVE dependencies impact" Arnout Engelen
  • Re: How to approach the problem of "3rd-party CVE dependencies impact" Piotr Karwasz
  • Re: How to approach the problem of "3rd-party CVE dependencies impact" Jarek Potiuk
• Website PR v2 Hen
• Website PR Hen
  • Re: Website PR sebb
  • Re: Website PR Hen
• Participating in HackerOne Internet Bug Bounty Arnout Engelen
• Applying for OSSF Best Practices Badge Program ? Jarek Potiuk
  • Re: Applying for OSSF Best Practices Badge Program ? Brian Behlendorf
  • Re: Applying for OSSF Best Practices Badge Program ? Arnout Engelen
• Dependency-Track INFRA ticket Chris Thistlethwaite
  • Re: Dependency-Track INFRA ticket Arnout Engelen
  • Re: Dependency-Track INFRA ticket Andrea Cosentino
• Using DOAPs for publishing SBOM links (and mandating it)? Jarek Potiuk
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Andrea Cosentino
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Gary Gregory
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Brandon Lum
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Jarek Potiuk
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Gary Gregory
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Jarek Potiuk
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Gary Gregory
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Jarek Potiuk
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Gary Gregory
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Jarek Potiuk
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Philippe Ombredanne
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Brandon Lum
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Jarek Potiuk
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Arnout Engelen
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Arnout Engelen
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Hen
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Gary Gregory
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Roman Shaposhnik
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Phil Steitz
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Jarek Potiuk
  • Re: Using DOAPs for publishing SBOM links (and mandating it)? Hen
• RFI on OSS Security and Memory Safe Programming Languages Mark J Cox
  • Re: RFI on OSS Security and Memory Safe Programming Languages Hen
  • Re: RFI on OSS Security and Memory Safe Programming Languages Arnout Engelen
  • Re: RFI on OSS Security and Memory Safe Programming Languages Hen
  • Re: RFI on OSS Security and Memory Safe Programming Languages Hen
  • Re: RFI on OSS Security and Memory Safe Programming Languages Mark J Cox
  • Re: RFI on OSS Security and Memory Safe Programming Languages Jarek Potiuk
  • Re: RFI on OSS Security and Memory Safe Programming Languages Andrea Cosentino
• Re: [REQUEST] Grant permission to deploy Maven project via GitHub Actions tison
  • Re: [REQUEST] Grant permission to deploy Maven project via GitHub Actions PJ Fanning
• Should we encourage projects to publish a 'security.txt'? Arnout Engelen
  • Re: Should we encourage projects to publish a 'security.txt'? Gary Gregory
  • Re: Should we encourage projects to publish a 'security.txt'? Paul King
  • Re: Should we encourage projects to publish a 'security.txt'? Mark J Cox
  • Re: Should we encourage projects to publish a 'security.txt'? Paul King
  • Re: Should we encourage projects to publish a 'security.txt'? Bertrand Delacretaz
  • Re: Should we encourage projects to publish a 'security.txt'? Arnout Engelen
  • Re: Should we encourage projects to publish a 'security.txt'? Jarek Potiuk
  • Re: Should we encourage projects to publish a 'security.txt'? Jonathan Leitschuh
  • Re: Should we encourage projects to publish a 'security.txt'? Gary Gregory
• advice on non-ASF CVE that I want to dispute/reject PJ Fanning
  • Re: advice on non-ASF CVE that I want to dispute/reject Mark J Cox
  • Re: advice on non-ASF CVE that I want to dispute/reject PJ Fanning
  • Re: advice on non-ASF CVE that I want to dispute/reject Hen
  • Re: advice on non-ASF CVE that I want to dispute/reject PJ Fanning
• Who can review security issues? Mike Drob
  • Re: Who can review security issues? Jacques Le Roux
  • Re: Who can review security issues? Mark J Cox
  • Re: Who can review security issues? Jarek Potiuk
  • Re: Who can review security issues? Hen
  • Re: Who can review security issues? Jarek Potiuk
• FOSS Security Campus Isabel Drost-Fromm
• Identifiers (purl, SWID) for Apache artifacts Arnout Engelen
  • Re: Identifiers (purl, SWID) for Apache artifacts Dirk-Willem van Gulik
  • Re: Identifiers (purl, SWID) for Apache artifacts sebb
  • Re: Identifiers (purl, SWID) for Apache artifacts Dirk-Willem van Gulik
  • Re: Identifiers (purl, SWID) for Apache artifacts Arnout Engelen
  • Re: Identifiers (purl, SWID) for Apache artifacts Dirk-Willem van Gulik
  • Re: Identifiers (purl, SWID) for Apache artifacts Gilles Sadowski
  • Re: Identifiers (purl, SWID) for Apache artifacts Jarek Potiuk
  • Re: Identifiers (purl, SWID) for Apache artifacts Dirk-Willem van Gulik
  • Re: Identifiers (purl, SWID) for Apache artifacts Jarek Potiuk
  • Re: Identifiers (purl, SWID) for Apache artifacts sebb
  • Re: Identifiers (purl, SWID) for Apache artifacts Arnout Engelen
  • Re: Identifiers (purl, SWID) for Apache artifacts Philippe Ombredanne
  • Re: Identifiers (purl, SWID) for Apache artifacts Dirk-Willem van Gulik
  • Re: Identifiers (purl, SWID) for Apache artifacts Gary Gregory
  • Re: Identifiers (purl, SWID) for Apache artifacts Jarek Potiuk
  • Re: Identifiers (purl, SWID) for Apache artifacts Dirk-Willem van Gulik
  • Re: Identifiers (purl, SWID) for Apache artifacts Arnout Engelen
• Vulnerability Listing pages Hen
  • Re: Vulnerability Listing pages Arnout Engelen
  • Re: Vulnerability Listing pages Mark J Cox
• ASF Security report for 2022 published Mark J Cox
• Reporting security vulnerabilities via Github Private security vulnerability ? Jarek Potiuk
  • Re: Reporting security vulnerabilities via Github Private security vulnerability ? Jonathan Leitschuh
  • Re: Reporting security vulnerabilities via Github Private security vulnerability ? Arnout Engelen
  • Re: Reporting security vulnerabilities via Github Private security vulnerability ? Arnout Engelen
  • Re: Reporting security vulnerabilities via Github Private security vulnerability ? Hen

• Earlier messages