From Fedora Project Wiki

(Removed communication links)
Line 9: Line 9:
== Security Response ==
== Security Response ==
The [[Security Team]] helps packagers fix security vulnerabilities in packages they maintain.  Most of these vulnerabilities come from the open source software community and packagers are notified by a ticket in [https://bugzilla.redhat.com Bugzilla].
The [[Security Team]] helps packagers fix security vulnerabilities in packages they maintain.  Most of these vulnerabilities come from the open source software community and packagers are notified by a ticket in [https://bugzilla.redhat.com Bugzilla].
=== Communicating ===
==== IRC ====
* {{fpchat|#fedora-security}} - general security questions
* {{fpchat|#fedora-security-team}} - FST IRC channel for working vulnerabilities
==== Mailing Lists ====
* {{fplist|security}} - General security mailing list (good for questions)
* {{fplist|security-team}} - Security Team mailing list


=== Reporting Vulnerabilities ===
=== Reporting Vulnerabilities ===
Line 26: Line 17:


Secure coding is writing code with security in mind from the beginning.  By not making security mistakes the code is more secure and time won't be wasted down the road having to rewrite or redesign features and functionality.
Secure coding is writing code with security in mind from the beginning.  By not making security mistakes the code is more secure and time won't be wasted down the road having to rewrite or redesign features and functionality.
=== Communicating ===
==== E-Mail List ====
* Fedora {{fplist|security}} list: For discussion about improvement of Fedora security.
==== IRC ====
* '''{{fpchat|#fedora-security}}''' - Fedora's Security SIG channel on Freenode.


=== Projects ===
=== Projects ===
Line 52: Line 36:
Many security vulnerabilities are found with the help of a code audit.  If you are interested in performing an audit please see our [[:Category:Code_Audit|auditing resource]] page.
Many security vulnerabilities are found with the help of a code audit.  If you are interested in performing an audit please see our [[:Category:Code_Audit|auditing resource]] page.


=== Communicating ===
==== IRC ====
* '''{{fpchat|#fedora-security}}''' - Fedora's Security SIG channel on Freenode.


[[Category:Documentation]]
[[Category:Documentation]]

Revision as of 17:09, 19 August 2016

The Security SIG has three missions that contributors can assist with:

  1. Security Response
  2. Secure Coding
  3. Code Auditing

Contributors can work on any or all of these missions.

Security Response

The Security Team helps packagers fix security vulnerabilities in packages they maintain. Most of these vulnerabilities come from the open source software community and packagers are notified by a ticket in Bugzilla.

Reporting Vulnerabilities

Security issues should be reported following the procedures outlined on the Security Bugs page.

Secure Coding

Secure coding is writing code with security in mind from the beginning. By not making security mistakes the code is more secure and time won't be wasted down the road having to rewrite or redesign features and functionality.

Projects

Defensive Coding book

The Defensive Coding book is published on the Fedora Docs website and is under development. The purpose of the book is to document common mistakes developers make and help educate developers on how to better their code from the beginning.

Training and Articles

In addition to the Defensive Coding book the Security SIG is charged with creating training resources. Videos and smaller articles on secure development can also be created to concentrate specific topics. These resources should be stored in the secure coding git repository.

Security Basics and HOWTO Articles

Basic Fedora security HOWTO is SecurityBasics

Code Auditing

Many security vulnerabilities are found with the help of a code audit. If you are interested in performing an audit please see our auditing resource page.