Re: GNU C Library as its own CNA?

[Florian Weimer <fweimer@redhat.com>]

* Siddhesh Poyarekar:

> At the outset, we'll need to have broad agreement on the following:
>
> 1. How should users submit issues?  We would need an independent,
> private mailing list, possibly one that can also do PGP for users to
> report security issues.
>
> 2. Identify a group of people who ought to be on that list.  A
> starting group could be a cross section of named maintainers from
> various distributions and FSF stewards but we probably need a way to
> make sure that the group is inclusive without being too broad.
>
> 3. A formal representation to the root CNA, i.e. Red Hat.  We would
> need a group of volunteers that would be willing to step in as signees
> for this.  I'm in, but I can't do it alone and would need more
> volunteers; it could perhaps be the same set of people who would be
> part of the initial security team in (2).

I think the CNA rules sort of assume that a CNA issues security
advisories:

  <https://www.cve.org/ResourcesSupport/AllResources/CNARules>

So we'd have to start doing that, too.

Thanks,
Florian