Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:116451
Message-ID: <eb797afa-5c95-f25b-816e-9c9fee10656a@gmx.de>
Date: Thu, 18 Nov 2021 15:36:47 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.3.1
Content-Language: de-DE
To: Nikita Popov <nikita.ppv@gmail.com>,
 Matthew Weier O'Phinney <mweierophinney@gmail.com>
Cc: Patrick ALLAERT <patrickallaert@php.net>,
 PHP internals <internals@lists.php.net>
References: <CAF+90c90pTtjxuMaQ88h+njhByfbv4qs=xx72CVPSw40tde6Cg@mail.gmail.com>
 <dde40b06-93c4-cb5b-0abf-48dfd8781fdf@telia.com>
 <CAF+90c_=GhEy0pX5wp9Hcj5+D31tjhhKBCSDCs4ofAoZj00_fA@mail.gmail.com>
 <25f35ef5-7f86-9aa3-a069-195a1ed39a91@gmx.de>
 <CACwt+JeLADQC6QvFt4m1gZCZ+oEeQnhSun-37T39bAR1N-uBjQ@mail.gmail.com>
 <CAF+90c9_u2BgDKywLMCfx9C3mFz-a-XZFeMe8NCvk8w4Fr1R0Q@mail.gmail.com>
 <CAJp_myWdQze1_WuL9ddDoi+1UTLUNz+9nU5_7hiKGG_-QhVqjg@mail.gmail.com>
 <CAF+90c_gpBbOEriHu0Gf-GFC16Fu4mpV90XaVgqBOzfQMCCoOw@mail.gmail.com>
In-Reply-To: <CAF+90c_gpBbOEriHu0Gf-GFC16Fu4mpV90XaVgqBOzfQMCCoOw@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: [RFC] Migrating to GitHub issues
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 18.11.2021 at 15:19, Nikita Popov wrote:

> On Thu, Nov 18, 2021 at 2:53 PM Matthew Weier O'Phinney <
> mweierophinney@gmail.com> wrote:
>
>> With Laminas, we use an email alias to allow researchers to report to u=
s.
>> We then post the full report as a security issue on GitHub - it's a fea=
ture
>> they rolled out late 2019/early 2020 that restricts visibility to
>> maintainers initially, but allows inviting others to collaborate (we in=
vite
>> the reporter immediately, for instance). It also creates a private bran=
ch
>> for collaboration. When the patch has been merged, you can mark the iss=
ue
>> public.
>
> Thanks for the suggestion! That does sound generally viable to me. Just =
to
> clarify, this is not making use of issues, but rather of "advisories",
> which GH implements as an independent feature.
>
> I'm not involved in security response, so I can't say whether the securi=
ty
> group would want to adopt such a process. This is probably something tha=
t
> should be decided among the people who handle security issues, rather th=
an
> here.

Yeah, I suggest to decouple the security reporting issue from this RFC.
 That can and should be decided by other people, and wouldn't need an
RFC, in my opinion.

Just a quick note here, that the handling of security reports is rather
suboptimal on bugsnet.  Patches need to be shared via secrets Gists (or
similar) since even the reporter can't access attached patches.

=2D-
Christoph M. Becker