Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:120673
Message-ID: <b73c6529-f5f0-91c8-94c6-40db2977baee@gmail.com>
Date: Sat, 24 Jun 2023 23:44:40 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.12.0
Content-Language: en-US
To: internals@lists.php.net
References: <CAF+90c90pTtjxuMaQ88h+njhByfbv4qs=xx72CVPSw40tde6Cg@mail.gmail.com>
 <dde40b06-93c4-cb5b-0abf-48dfd8781fdf@telia.com>
 <CAF+90c_=GhEy0pX5wp9Hcj5+D31tjhhKBCSDCs4ofAoZj00_fA@mail.gmail.com>
 <25f35ef5-7f86-9aa3-a069-195a1ed39a91@gmx.de>
 <CACwt+JeLADQC6QvFt4m1gZCZ+oEeQnhSun-37T39bAR1N-uBjQ@mail.gmail.com>
 <CAF+90c9_u2BgDKywLMCfx9C3mFz-a-XZFeMe8NCvk8w4Fr1R0Q@mail.gmail.com>
 <CAJp_myWdQze1_WuL9ddDoi+1UTLUNz+9nU5_7hiKGG_-QhVqjg@mail.gmail.com>
 <d68fc8c9-4e5e-2bd7-6e02-e5afe1fc4c10@gmail.com>
 <CAF+90c-Lbtav0dhAuPi0g2hox2MgNNRNagzxusBSoWvAAg-2Ow@mail.gmail.com>
 <8fbb3af9-5fb5-1220-3b88-a42f5aaa40ef@gmx.de>
 <59f61bd5-8212-47af-857e-b452705b1811@app.fastmail.com>
 <ccee0a69-9e60-512a-e9fd-3d1f7d41f143@gmx.de>
 <c6e3ebd5-7948-4f7d-89e5-2ddfd7c7da7c@app.fastmail.com>
In-Reply-To: <c6e3ebd5-7948-4f7d-89e5-2ddfd7c7da7c@app.fastmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] Re: [RFC] Migrating to GitHub issues
From: dossche.niels@gmail.com (Niels Dossche)

On 6/24/23 21:39, Nikita Popov wrote:
> On Fri, Dec 30, 2022, at 22:39, Christoph M. Becker wrote:
>> On 30.12.2022 at 22:12, Nikita Popov wrote:
>>
>>> On Thu, Nov 10, 2022, at 14:29, Christoph M. Becker wrote:
>>>
>>>> On 09.11.2022 at 23:27, Nikita Popov wrote:
>>>>
>>>>> It looks like GitHub has just added support for private security reports:
>>>>> https://github.blog/changelog/2022-11-09-privately-report-vulnerabilities-to-repository-maintainers/
>>>>>
>>>>> I haven't looked into the details, but it probably makes sense to enable
>>>>> those on php-src and make this our official venue for security bug reports.
>>>>> This would allow retiring the last remaining use of bugs.php.net (well,
>>>>> apart from the archive of old issues, which should of course remain).
>>>>
>>>> I agree, but maybe the security team is in favor of sticking with
>>>> bugs.php.net.
>>>
>>> I noticed that the php-src repo does enable private vulnerability reports now, and there is one sitting around without response at https://github.com/php/php-src/security/advisories/GHSA-54hq-v5wp-fqgv.
>>>
>>> Possibly this was enabled unintentionally / without coordination with the security team? That should probably either be disabled again, or someone needs to keep an eye on it.
>>
>> I had enabled that some weeks ago, since there has been a spam attack on
>> bugsnet, so we could test the new feature.  I probably should have
>> written to list right away, or at least have kept an eye on it, but I've
>> assumed to be notified about reported issues.
>>
>> I'll have a closer look at the rather verbose report tomorrow, if nobody
>> beats me to it.
>>
>> Generally, I'm in favor of keeping security reports on Github enabled;
>> we should stop user (not developer) comments on bugsnet as soon as
>> possible; there is already more spam than useful comments for quite a
>> while, and I think Github offers better feature to handle that.
>>
>> Regarding the access rights on security advisories: currently only php
>> owners[1] may see and collaborate there.  To my knowledge, most of those
>> who are subscribed to the security mailing list are already in that
>> group, but if need be, others might be added, or maybe it's preferable
>> to create a new team for this.
>>
>> Thoughts?
> 
> Security bug reports on GitHub have been active for a while now, with about 10 reports having been processed.
> 
> I wanted to check back whether security folks are happy with the process, and whether it is time to make this the official channel for security reports, which would allow us to disable issue creation on bugs.php.net entirely. (I saw that the reports are 90% spam at this point.)
> 
> Regards,
> Nikita
> 

FWIW, if you press the "new issue" button on GitHub you get to this page: https://github.com/php/php-src/issues/new/choose
If you choose the last option "Security Issue" you still get redirected to the bugs.php.net bugtracker.
Interestingly, there's also a "Report a security vulnerability" option in the middle which brings you to the private report page on GitHub.
I guess this should be updated too.

Kind regards
Niels