DragonFly Security Officer and Security Team

[Hiten Pandya]

It is not just about picking committers with free time and better 
understanding of code.  The people elected should have more than 
adequate knowledge of security concepts.

To conclude, all I am saying is that such a team is not necessary right 
now; but... when we do plan on creating such a team, I would rather put 
people with proven track record in security related things and just 
anyone.  I do not mean to offend anyone's attempt at contribution or 
giving their time.

Kind regards,

     Hiten Pandya

Devon H. O'Dell wrote:
Hello all,

``Who can act as a security officer and participate in a security team 
for our project?''

This is a question that I've discussed before with the members of 
#DragonFlyBSD when I joined the project. At the time, it seemed to be 
considered a bit of an unnecessary position. I think as our project 
grows, we will need to formalize this matter a bit. There are good, 
specific reasons to organize a team and a head for this matter; it makes 
inter-project communication regarding security vulnerabilities easier 
and safer.

Unfortunately, obscurity is critical when a vulnerability is discovered. 
As it stands, it is difficult to find anybody to contact privately when 
such a matter is revealed. It may or may not be obvious to some who the 
head developers of the project are and it may or may not be obvious 
whether or not they have time to deal with the issue.

I think formalization of this issue is in order. I certainly have time 
to work in a team and I can probably even allocate enough to act as an 
officer, but I'm not a committer and have contributed relatively little 
to the project code-wise (the lockf(2) patch being virtually everything, 
disregarding installer work and giving my 2 cents on every subject 
that's discussed on IRC), so I'm not sure that I am the most qualified 
person for either of these positions.

I'm certainly up for serving as either (officer / team member) and 
failing either would certainly work to coordinate the gathering of a 
team which is qualified for such a position.

I hope we can get something worked out with this.

Kind regards,

Devon H. O'Dell