Re: Call for volunteer(s) for Guix "security" web page

[ng0 <ngillmann@runbox.com>]

Hi,

I think this is a good idea, thanks for bringing this up.

Leo Famulari <leo@famulari.name> writes:

> Hello!
>
> GNU Guix should make it easier for bug reporters to contact us to report
> issues in Guix and Guix packages.
>
> So, we'd like to add a short "Security" page to our web site [0]. This
> page should:

I think we (you?) should post this (not cross post / CC) to other lists
as well, to gain some more attraction.

> 1) Explain how to contact us privately about security issues [1],
>
> 2) Describe the Guix release signing key [2],
>
> 3) And include a link to the security updates section of the manual [3].
>
> The page should be clear and concise. The main objectives are to make it
> easy for bug reporters to learn how to contact us, and to make it easy
> for anyone to know which key is used to sign our downloads.

In my opinion this could be extended later by something similar to
https://security.gentoo.org/ and its subpages.
As we don't have much on that topic currently, we can't write about
it. If this would be too much for the website, an inclusion in the
manual of which security measurements a vanilla Guix offers would be
good.
One example: I stumbled upon our /dev/mem configuration only when I
wanted to use flashrom for internal flashing. This is not documented
anywhere.

> Does anyone volunteer to make this page?
>
> I like this example, although it does some things we don't plan to do at
> this time, such as provide a key for securely contacting the project,
> and explain how to use GnuPG:
>
> https://syncthing.net/security.html
>
> [0] Our web site is maintained in guix-artwork.git:
> git://git.savannah.gnu.org/guix/guix-artwork.git
>
> [1] Private communication should go to <guix-security@gnu.org>
> https://lists.gnu.org/mailman/listinfo/guix-security
>
> [2] The key should be described by the key fingerprint.
> https://www.gnu.org/software/guix/manual/html_node/Binary-Installation.html
>
> [3]
> https://www.gnu.org/software/guix/manual/html_node/Security-Updates.html

-- 
              ng0