OK, I am going ahead and including [email protected] in this discussion, then all of us can see what's being discussed.
I am adding the full text of what Michael was replying to as well. Simon proposes something more promising, from my viewpoint, beyond bilateral ownership between AOOo and TDF. He is looking for a multilateral solution using securityteam@ OO.o, and this [DISCUSS] was started in response to Simon's proposal. There have been objections to this being only bilateral between AOOo and TDF. A multilateral approach is preferred for how the list conducts itself and how participants are able to ensure coordination with their own private security operations when an issue of common concern comes to light. Securityteam@ OO.o has a multilateral membership, I presume. That was workable under Sun and OASIS custodianship and there is no reason to assume that ASF (not AOOo) is not a reliable custodian in that regard with regard to operational support, preserving security of the list, dealing with outages, etc. This is not about what happens on the list, but fundamental IT operational support and the serious desire to ensure security and preservation for the list and its archives. ASF (not AOOo) has strong, enduring capabilities in that regard. It also manages an overall security@ operation and supports the various security teams associated with individual Apache projects. Since ASF has been granted the domain name, the continuation of securityteam@ OO.o will come under ASF infrastructure operation at some point, in some manner. If the list can be preserved using the already-known list address, that will be the least disruptive, operationally. How governance is dealt with on the list is independent of custodianship and has to be worked out whoever hosts the list. Commitment to multilateral governance is not a JFDI. - Dennis -----Original Message----- From: Marc-André Laverdière [mailto:[email protected]] Sent: Friday, October 21, 2011 10:51 To: [email protected] Cc: [email protected]; [email protected]; 'lsecurity'; 'Simon Phipps' Subject: RE: [DISCUSS] Neutral / shared security list proposal I tend to go for the "just get it done" philosophy when we reach that point. So let me summarize what that'd mean for me: - Michael registers us a neutral mailing list and both teams register 3-4 folks - We stick with the 'old' ml with the suggested membership structure. Like, seriously... just get it done ;) > Excuse me Michael, the proposal I am referring to was offered by Simon > Phipps > and I included his message. > > If you don't want to accept the OUTLINE PROPOSAL or start from it as a > point > of discussion, that is fine. Just be clear that Simon's proposal was the > one > that I was replying about and proposing be [DISCUSS]ed on ooo-dev too. > > I was hoping that Simon's good offices in mediating this would be > valuable. > Is that not acceptable? > > What I like about Simon's proposal is that it is the least disruptive, and > it > adds meritocracy and (private) transparency features to how > [email protected] > operates. I assume that the current securityteam@ OO.o list would be > grandfathered in. Why not? > > I pointed out in starting this [DISCUSS] thread that there is enough > connection from ooo-security so that ASF can be represented well enough in > discussion on securityteam@ OO.o to forward Simon's proposal, if there is > agreement to do that. I don't see where anything about myself, Rob, and > Caolan are in the message you are responding to. > > With regard to how the list software works/might-not/doesn't, can these 2d > and > 3rd order issues be deferred until the big questions are handled? > > - Dennis > > -----Original Message----- > From: Michael Meeks [mailto:[email protected]] > Sent: Friday, October 21, 2011 10:07 > To: [email protected] > Cc: 'Simon Phipps'; [email protected]; lsecurity > Subject: Re: [DISCUSS] Neutral / shared security list proposal > > Hi Dennis & list, > > On Fri, 2011-10-21 at 08:11 -0700, Dennis E. Hamilton wrote: >> It is not something that can be done unilaterally here on the AOOo >> podling. >> Do you propose that this be discussed at securityteam@ OO.o? It would >> seem that is where consensus is required. > > Last I checked only a few from TDF's security group are on that list; > so it doesn't seem an ideal forum either. Lets just CC our security team > as I've done. > > I am mildly amused by the convenient deployment of the argument type: > "we have always done it this way" from a project undergoing such a lot > of (in many ways positive) changes. Combine this with a world of > extraordinary possibilities such as: mail forwarding and the "mail > address is well known" bites the dust. There were many projects and > people I used to admire in the ASF, but claiming it is neutral in > today's world is not sensible. > > I would like to see, and think it is reasonable to ask for: > > 1. a neutral domain / list name > 2. a comprehensive set of moderators / admins cf. previous > 3. neutral hosting > > It seems vs. the present that the ASF guys are suggesting to compromise > on only one of these points (2.) ie. having two Apache supporters (Rob + > Dennis) as moderators, and one TDF guy (me or Caolan): is that right ? > > At a big stretch, assuming there is no heavy-governance-petting > anywhere near it, I could cope with not having 3. ie. Apache hosting it > - after all, that is rather invisible [ but I personally loathe reply-to > mangling - I don't believe we would want that pushed onto us ]. > > So - where do we go from there ? it looks to me like no compromise is > possible (for some definitions of compromise). We could create two > 'neutral' mailing lists one at each side, with cross subscriptions to > our own security lists - but it all seems a bit pointless. > > Regards, > > Michael. > > -- > [email protected] <><, Pseudo Engineer, itinerant idiot > -----Original Message----- From: Dennis E. Hamilton [mailto:[email protected]] Sent: Friday, October 21, 2011 08:11 To: 'Simon Phipps' Cc: 'Michael Meeks'; [email protected] Subject: [DISCUSS] Neutral / shared security list proposal I'm not sure Simon noticed this. Here's a follow-up, with a fresh thread. Simon, what is the next action on this proposal? It is not something that can be done unilaterally here on the AOOo podling. Do you propose that this be discussed at securityteam@ OO.o? It would seem that is where consensus is required. AOOo ooo-security follows that list, as I described previously. And there appear to be at least three of us from the AOOo PPMC that are individually subscribed. So AOOo representation in the discussion can be assured. What's next? - Dennis E. Hamilton tools for document interoperability, <http://nfoWorks.org/> [email protected] gsm: +1-206-779-9430 @orcmid -----Original Message----- From: Dennis E. Hamilton [mailto:[email protected]] Sent: Wednesday, October 19, 2011 17:51 To: [email protected]; [email protected] Cc: 'Michael Meeks' Subject: RE: Neutral / shared security list ... OK Simon, but I am talking about custodial responsibility too, not just the manner in which list administration and moderation are handled. I personally have no objection to the governance you propose in your second and third bullets. I have no idea how it is done right now, since I am new to that list. However ooo-security has been receiving mail from that list since 2011-10-13 and I have not seen any governance discussions, nor any indication of additions to the list in any way. It seems to me that your proposal should go to securityteam@ as well [;<). I assume there are enough individuals there that are empowered to hammer this out. In that case, any intervention from ASF security@ observers of securityteam@ would be if the house was on fire and from Apache Infra if the list was seen to be hacked or anything required immediate intervention, such as shutting down and restoring the list, anything else appropriate. These are operational responsibilities that require someone with IT-operations level access to the equipment. Does that work better for you? - Dennis -----Original Message----- From: Simon Phipps [mailto:[email protected]] Sent: Wednesday, October 19, 2011 16:19 To: [email protected]; [email protected] Cc: Michael Meeks Subject: Re: Neutral / shared security list ... On Wed, Oct 19, 2011 at 10:56 PM, Dennis E. Hamilton <[email protected]>wrote: If securityteam@ OO.o is preserved, I believe the oversight of security@ > apache.org and the care of Apache infrastructure is a bonus. I disagree. Having an arbitrary steward - regardless of their excellence - is not the way to sustain (or indeed rebuild) trust. The correct oversight is the list-members themselves. OUTLINE PROPOSAL: Thus I'd propose (in outline): * That [email protected] be used as the shared meta-community security contact list for projects deriving their source code from the former Sun-led OpenOffice.org project. The list would be used for any valid meta-community security matter including especially announcement co-ordination. * That the list should be private to list members (and with the consent of the list, to their project's private security list), with mutually agreed confidentiality, and populated only with people known to the majority of the list members as bona-fides security-related developers. * That the list be populated only with the consent of the existing list members (suggested process: a list member proposes a new list member with a brief explanation why they are a good-faith and experienced security developer in the meta-community. Code-modification-style voting takes place. A moderator adds the new member. In the event of mishap, list members may be removed using the same process). * Agreeing who the moderators should be by list-member consensus I'm sure this needs fleshing out by someone more process oriented, but I suggest this outline represents a workable compromise. Regards S.
