Thanks for bringing this up, Dian. +1 on creating a project specific security mailing list. My two cents, I think it is worth doing in practice.
Although the ASF security ML is always available, usually all the emails are simply routed to the individual project PMC. This is an additional hop. And in some cases, the best person to address the reported issue may not be a PMC member, but a committer, so the PMC have to again involve them into the loop. This make things unnecessarily complicated. Having a project specific security ML would make it much easier to have everyone at the same table. Also, one thing to note is that even though the security issues are usually rare, they could be devastating, thus need to be treated seriously. So I think it is a good idea to establish the handling mechanism regardless of the frequency of the reported security vulnerabilities. Thanks, Jiangjie (Becket) Qin On Fri, Nov 15, 2019 at 1:14 AM Yu Li <car...@gmail.com> wrote: > Thanks for bringing up this discussion Dian! How to report security bugs to > our project is a very important topic! > > Big +1 on adding some explicit instructions in our document about how to > report security issues, and I suggest to open another thread to vote the > reporting way in Flink. > > FWIW, known options to report security issues include: > 1. Set up secur...@flink.apache.org and ask users to report security > issues > there > 2. Ask users to send security report to secur...@apache.org > 3. Ask users to send security report directly to priv...@flink.apache.org > > More details: > > Descriptions on http://apache.org/security/: > *============================================* > > *We strongly encourage folks to report security vulnerabilities to one of > our private security mailing lists first, before disclosing them in a > public forum.* > > *A list of security contacts for Apache projects > <http://apache.org/security/projects.html> is available. If you can't find > a project specific security e-mail address and you have an undisclosed > security vulnerability to report then please use the general security > address below.* > > > *The general security mailing list address is: secur...@apache.org > <secur...@apache.org>. This is a private mailing list.* > *============================================* > > There are also projects directly using private@ mailing list to report > security issues such as HBase (as documented at the very beginning in its > online ref-guide book here <http://hbase.apache.org/book.html#_preface>). > > Hope these information helps. Thanks. > > Best Regards, > Yu > > > On Thu, 14 Nov 2019 at 18:11, Chesnay Schepler <ches...@apache.org> wrote: > > > Source: https://www.apache.org/security/ > > > > Now, we can of course setup such a mailing list (as outlined here > > https://www.apache.org/security/committers.html), but I'm not sure if it > > is necessary since the number of reports is _really_ low. > > > > On 14/11/2019 11:03, Chesnay Schepler wrote: > > > AFAIK, the official way to report vulnerabilities in any apache > > > project is to write to secur...@apache.org and/or notify the > > > respective PMC. So far, we had several reports that went this route, > > > hence I'm not convinced that an additional ML is required. > > > > > > I would be fine with an additional paragraph somewhere outlining this > > > though. > > > > > > On 14/11/2019 06:57, Jark Wu wrote: > > >> Hi Dian, > > >> > > >> Good idea and +1 to setup security mailing list. > > >> Security vulnerabilities should not be publicly disclosed (e.g. via > > >> dev ML > > >> or JIRA) until the project has responded. > > >> However, AFAIK, Flink doesn't have an official process to > > >> report vulnerabilities. > > >> It would be nice to have one to protect Flink users and response > > >> security > > >> problems quickly. > > >> > > >> Btw, we may also need a dedicated page to describe the security > > >> vulnerabilities report process and CVE list on the website. > > >> > > >> Best, > > >> Jark > > >> > > >> > > >> > > >> On Thu, 14 Nov 2019 at 13:36, Hequn Cheng <chenghe...@gmail.com> > wrote: > > >> > > >>> Hi Dian, > > >>> > > >>> Good idea! +1 to have a security mailing list. > > >>> It is nice for Flink to have an official procedure to handle security > > >>> problems, e.g., reporting, addressing and publishing. > > >>> > > >>> Best, Hequn > > >>> > > >>> On Thu, Nov 14, 2019 at 1:20 PM Jeff Zhang <zjf...@gmail.com> wrote: > > >>> > > >>>> Thanks Dian Fu for this proposal. +1 for creating security mail > > >>>> list. To > > >>> be > > >>>> noticed, security mail list is private mail list, could not be > > >>>> subscribed > > >>>> publicly. > > >>>> FYI, apache member can create mail list using this self service tool > > >>>> https://selfserve.apache.org/ > > >>>> > > >>>> > > >>>> jincheng sun <sunjincheng...@gmail.com> 于2019年11月14日周四 > > >>>> 下午12:25写道： > > >>>> > > >>>>> Hi Dian, > > >>>>> > > >>>>> Thanks a lot for bringing up this discussion. This is very > important > > >>> for > > >>>>> Flink community! > > >>>>> > > >>>>> I think setup a security mailing list for Flink is pretty nice > > >>> although ` > > >>>>> secur...@apache.org` can be used and the report will be forwarded > to > > >>>> Flink > > >>>>> private mailing list if there is no project specific security > mailing > > >>>>> list. One thing that is pretty sure is that we should guide users > on > > >>> how > > >>>> to > > >>>>> report security issues in Flink website as security vulnerabilities > > >>>> should > > >>>>> not be entered into a project's public bug tracker directly > according > > >>> to > > >>>>> the guidance for how to handling the security vulnerabilities in > ASF > > >>>>> site[1]. > > >>>>> > > >>>>> Besides, we need also add a security page in Flink which shows the > > >>>>> information about the security vulnerabilities per the guidance of > > >>>>> the > > >>>>> security vulnerabilities in ASF site[2]. Projects such as spark[3], > > >>>>> kafka[4], etc already have such a page. > > >>>>> > > >>>>> Best,Jincheng > > >>>>> > > >>>>> [1] > > >>>> > > https://www.apache.org/security/committers.html#vulnerability-handling > > >>>>> [2] > > >>>> > > https://www.apache.org/security/committers.html#publishing-information > > >>>>> [3] https://spark.apache.org/security.html > > >>>>> [4] https://kafka.apache.org/cve-list > > >>>>> > > >>>>> Dian Fu <dian0511...@gmail.com> 于2019年11月14日周四 下午12:12写道： > > >>>>> > > >>>>>> Hi all, > > >>>>>> > > >>>>>> I'm reaching out to see if there is an existing security specific > > >>>> mailing > > >>>>>> list in Flink. If there is, we should expose it in the offcial web > > >>> site > > >>>>> of > > >>>>>> Flink [1] to guide people to report security issues to this > mailing > > >>>> list. > > >>>>>> If it still doesn't exist, I'm here to propose to setup a > > >>>>>> secur...@flink.apache.org mailing list for reporting and > discussion > > >>> of > > >>>>>> security specific issues. Currently, most well known apache > projects > > >>>> such > > >>>>>> as apache common[2], hadoop[3], spark[4], kafka[5], hive[6], etc > > >>> have a > > >>>>>> security specific mailing list. It would be nice if there is also > a > > >>>>>> security specific mailing list for Flink. > > >>>>>> > > >>>>>> Note that users should report security issues to the security > > >>>>>> mailing > > >>>>>> list. > > >>>>>> > > >>>>>> Looking forward to your feedback! > > >>>>>> > > >>>>>> Regards, > > >>>>>> Dian > > >>>>>> > > >>>>>> [1] https://flink.apache.org/community.html > > >>>>>> [2] https://commons.apache.org/mail-lists.html > > >>>>>> [3] https://hadoop.apache.org/mailing_lists.html > > >>>>>> [4] https://spark.apache.org/community.html > > >>>>>> [5] https://kafka.apache.org/project-security.html > > >>>>>> [6] https://hive.apache.org/mailing_lists.html > > >>>> > > >>>> -- > > >>>> Best Regards > > >>>> > > >>>> Jeff Zhang > > >>>> > > > > > > > > > > >
