DUE TO SPAM, SIGN-UP IS DISABLED. Goto Selfserve wiki signup and request an account.
...
- Have a better EOL policy with defined communication routes, policy for CVE in EOL releases.
- More 2FA requirements
- Consider if projects that are not releasing regularly are really healthy. Could they realistically respond to a security vulnerability in a reasonable time frame?
- Make sure we upgrade our CNA CVE process to JSON 5.0 to make use of the additional record data
- Would OpenSSF sigstore be a future replacement for current signing policies
- Should have more complete policy around production of "builds" https://www.apache.org/legal/release-policy.html#compiled-packages
- Look at OpenSSF AllStar
- Sometimes communication with vulnerability reporters breaks down, is it time to have a more structured tool for handling reports which forces the process? or just have our CVE tool give reminders / require checkboxesis it more people engagement? or can we just require checkboxes before allocating CVE names in our existing tool?
WH Theme: Preventing Defects
...