Re: GNU C Library as its own CNA?

[Siddhesh Poyarekar <siddhesh@gotplt.org>]

On 2023-09-06 18:01, Alexandre Oliva wrote:
> No, that would be reading too much into what I wrote about an earlier
> attempt to make GNU a CNA.

OK, thanks for clarifying.  Then I continue to look for volunteers.

> I'd just be surprised if anyone serious about software freedom and
> security would seriously consider engaging with that web site while it
> remains detrimental to both of these concerns.
> 
> If we can find people who don't mind interacting with it as it is, I
> suppose we might, but there might be continuity challenges, and, having
> been denied access to the site because of javascrippling, I don't even
> know how much of a commitment by any community it would amount to.
> 
> I expect finding people who care about freedom and security but don't
> mind interacting with that website to be difficult, so that is a point
> of concern for me.
> 
> If we do find a path forward, however, it would be useful to extend it
> to all of GNU, because there was much interest, we just couldn't figure
> out a way to make interaction viable.

That would be a worthy goal, but it may be best to have individual CNAs 
for glibc, binutils, gcc, etc. because it allows the individual 
communities to nominate their own security teams for example and run 
independently.  Lets see how the glibc experiment goes and then we can 
extend the idea to other parts of the toolchain.

Thanks,
Sid