Subject: Re: Security information page

From: "Magnus Hagander" <[email-masked]>
Date: Sun, 27 Nov 2005 21:52:37 +0100

> > Per some discussion last week, I've put together a page 
> with security 
> > information. Basically an introduction written by Simon and 
> a table I 
> > pulled together by going through the CVE list and matching 
> it up with 
> > our cvs versions.
> 
> : All security issues are always fixed in the next major release, when
> : it comes out.
> 
> Perhaps "all known security issues..."  The statement as made 
> is hopelessly hubristic.

Typo. Thanks. Certainly didn't intend it as anything else than all
*known*.

> Please remove the statements about how we will respond within 
> X hours or days.  That has nothing to do with reality.  
> (Reality is that we are often constrained by CVE publication 
> dates if the fix is trivial, and if it isn't trivial then it 
> won't be fixed instantly anyway.)  I'd lose the whole 
> paragraph beginning "PGDG's aim ..."

Ok. I'll zap it. I guess it can be read as a promise, which it really
isn't. "Marketing info" about the speed of patching probably belongs on
a different page.

> I think the bit about "Our goal is to gain and maintain 
> CVE-compatible status" is bogus.  As near as I can tell, 
> Mitre's definition of CVE compatibility applies to security 
> products (eg, vulnerability scanners) which Postgres is not.  

Um. Not really - products like Debian are CVE compatible
(http://www.us.debian.org/security/cve-compatibility), so it's not just
for security products.

> You could maybe say that this one web page is something that 
> could apply for CVE compatibility status, but are we going to 
> jump through those hoops for one web page?  Nyet.

Right. I'll take that off until such a time as we're further along that
process (see Simons mails).

Looks better now?

> The list seems a bit short; did you look through the release 
> notes for items that seem to be security issues?  I suspect 
> there are some that don't have CVE names.

No, I cheated and did only the CVE list, hoping they did their homework
;-). Limiting the list to 7.3+ cut it dow nquite a bit.

I'll go through the release notes and see what I can find.
Point-releases only should be enough, right? (since they'd be
back-patched from HEAD when found).

Thanks for your quick review!

//Magnus

---

From: Simon Riggs <[email-masked]>
Date: Sun, 27 Nov 2005 22:51:05 +0000

On Sun, 2005-11-27 at 21:52 +0100, Magnus Hagander wrote:
..Tom Lane wrote
> process (see Simons mails).

I'll re-raise this as a separate item, later; one step at a time.

> Looks better now?

And the first step looks very good now.

Best Regards, Simon Riggs