Consensus: Security Hall of Fame, Security issue attributions, NEWS, and Contribution Checklist.

[Joseph Myers]

On Wed, 21 Oct 2015, Carlos O'Donell wrote:

> > Rather than the suggested NEWS section I'd rather say that each bug with a 
> > CVE gets its own entry in the NEWS file (in addition to the general list 
> > of fixed bugs) and that those entries credit the reporter.
> 
> Would you be OK if we expanded this to all security+ bugs get their own
> NEWS entry and that those entries credit the reporter?

I suppose so, though some security+ bugs are pretty obscure.

> While we would like all security+ bugs to have a CVE it isn't a hard and
> fast requirement right now, and in some cases we might not get a CVE for
> certain bugs, but might still want to mark them security+ and mention
> them as security bugs in the release NEWS.

I think we had consensus for Florian to assign CVEs for public security 
bugs as per <https://sourceware.org/ml/libc-alpha/2015-10/msg00034.html> 
(though I don't know how much work such an assignment is per bug, or how 
many of the current security+ bugs - 97 including closed bugs; 13 open; 13 
open bugs have security? and 64 open bugs have no security flag set either 
way - have them).

-- 
Joseph S. Myers
joseph@codesourcery.com