Re: GNU C Library as its own CNA?

[Florian Weimer <fweimer@redhat.com>]

* Paul Eggert:

> On 2023-07-28 09:41, Joseph Myers wrote:
>> If we add some kind of private submission
>> mechanism, we should also strongly discourage its use for the bulk of
>> low-risk issues to avoid adding unnecessary overhead for those.
>
> One possibility is to use an already-existing submission mechanism,
> namely the GNU Security Escalation Contact <security@gnu.org>. For
> what it's worth, that mailing list gets little email, mostly false
> alarms.
>
> https://savannah.gnu.org/mail/?group=security

That's not the documented purpose of <security@gnu.org>:

| Security Team
| 
| The Security Team <security@gnu.org> helps to resolve security bugs in
| a timely fashion. If the maintainer of a GNU package fails to respond
| to a report of a security flaw, the reporter can escalate the issue to
| the security team. If it decides the issue is urgent, it can develop a
| patch and publish a fixed release of the package. Maintainers can also
| ask the security team for advice in securing their packages.
| 
| New members are recruited from existing GNU volunteers when needed.

<https://www.gnu.org/gnu/gnu-structure.html#security>

It's clearly not intended as an external first point of contact.

Thanks,
Florian