Where to discuss security issues of Eclipse IDE?

[jukzi]

Please add a SECURITY.md

[laeubi]

https://gitlab.eclipse.org/security/vulnerability-reports

[jukzi]

Do we commit/review security fixes publicly on GitHub?

[laeubi]

I think such question is best be directed to the security team: https://www.eclipse.org/security/team.php

[mrybczyn]

To avoid such questions in the future, it is a good practice to have SECURITY.md in your repository that answers to the question on how to report a vulnerability. Do I propose a PR?

[laeubi]

@mrybczyn PR is always welcome.

[mrybczyn]

Here it is: eclipse-platform/eclipse.platform#610

The policy file is already available when someone looks into GitHub security settings at https://github.com/eclipse-platform/.github/security/policy but adding a file directly in the repository makes it more obvious when someone has a repository clone.

[jukzi]

Who volunteers to discuss/review security issues privately?

[jonahgraham]

Does this mean that committer/leads have to address security issues? Or does it only mean that fixes for them have to be accepted?

All I can do is quote the policy here, I can't speak in more depth. If you are concerned about the policy then please raise it with the Eclipse Architecture Council (via the PMC or any of the AC members. I am an AC member, but there are many others)

[merks]

It is generally expected that projects will fix security issues. But that doesn’t make it any particular individual’s obligation to do all the work. Blocking the contribution of security fixes would be seen as unreasonable behavior.

[HannesWell]

It is generally expected that projects will fix security issues. But that doesn’t make it any particular individual’s obligation to do all the work. Blocking the contribution of security fixes would be seen as unreasonable behavior.

Yes definitely, they should be fixed and of course the contribution should not blocked (unless there is a very good reason).
I was just thinking about the, hopefully hypothetical, scenario of a security issue that nobody knows a solution for or for that a solution would very much work and nobody steps up to do it that in the end the project leads are obligated to fix it.

[mickaelistria]

So do I get it right that according to the policy, all committers should be considered as security maintainers and be notified for security advisories, just as much as they're expected to be notified about new bugs? I think it would be best for project, better than trying to get a subset of individual responsible.

[merks]

Note that I am not a lawyer and my statements are my personal interpretation. I think a security problem is "just" an extremely serious bug that should be take extremely seriously. No individual or subset of individuals is more obligated to fix it than any other subset. Certainly the team lead has extraordinary responsibilities to "manage" the project and I can image some projects will want to identify security experts within the project for helping manage such problems. That's up to the project to manage. If a project cannot resolve a security issue, for whatever reason, the Foundation can choose to assign resource to help resolve the issue, including behaving as if that assigned resource has committer rights to commit those changes.