Add SECURITY.md #264
Open
Add SECURITY.md #264
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
maertsen
reviewed
Feb 9, 2024
There was a problem hiding this comment.
Two general observations:
- the term 'support' is not defined here, nor on our website. The filename and first heading here implicitly conveys that 'support' is related to 'security', while the (same) text on the website is not in a security specific context and presumably is about where continued development happens.
- the (general) statement about no backporting of security fixes may be read to conflict with the (specific) statement about support for the latest minor version of a previous major version. I am assuming that "specific beats general" and therefore this is an exception to the 'no backporting' rule. But perhaps it is not. I think it would be helpful to clarify this.
|
|
||
| ## Reporting a Vulnerability | ||
|
|
||
| We take security very seriously. If you have discovered a security vulnerability |
There was a problem hiding this comment.
Suggested change
| We take security very seriously. If you have discovered a security vulnerability | |
| If you have discovered a security vulnerability |
| ## Reporting a Vulnerability | ||
|
|
||
| We take security very seriously. If you have discovered a security vulnerability | ||
| in one of our projects and you would like to report it to us, you can send an |
There was a problem hiding this comment.
Suggested change
| in one of our projects and you would like to report it to us, you can send an | |
| in one of our projects and you would like to report it to us, please send an |
| older (minor) versions. In the event a new major version is released (e.g. from | ||
| 3.2.18 to 4.0.0), support will also be provided on the latest minor version of | ||
| the previous major version (3.2.18) for a period of one year from the release of | ||
| the new major version (4.0.0). |
There was a problem hiding this comment.
Suggested change
| the new major version (4.0.0). | |
| the new major version (4.0.0), unless the previous major version number was 0 (the 'initial development phase'). |
|
I also stumbled over the lack of definition of “support.” I’m assuming it to mean security and bug fixes, but we should probably say that? |
Comment on lines
+5
to
+6
| NLnet Labs adheres to the straightforward, semantic versioning scheme that is | ||
| commonly used in the software industry. |
There was a problem hiding this comment.
If we want to do this properly, we should probably set up cargo-semver-checks at some point.
There was a problem hiding this comment.
If you could have a look at this at some point for other projects such as Routinator and Krill, that would be nice.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.