what's this security policy about?

[johnsonjh]

what's this security policy about?

[johnsonjh]

Mostly boilerplate text to "check the box" and agree mostly redundant - the verbiage is actually less specific than the license, so I'll just remove that.

supported releases? i would say, there is no support at all, cause this is no commercial product

'supported' in this context should be clarified as in "only report fixing bugs that affect the latest "release" tag version. I'll reword.

The presence of the SECURITY.md file will automatically enable a few "standard" URLs that are used by distribution package tracking - for example, the https://github.com/johnsonjh/duma/security/policy link.

who is [email protected] ? as this library should not get delivered - and is "just" for development ..

The email goes to me - I will make that more apparent.

While it's not strictly mandatory, having a "non-public" contact for reporting bugs deemed sensitive and is important criteria for distribution inclusion.

also, it's the only way you'll ever receive some bug reports from reporters that have defined "responsible disclosure" rules that prevent them from making public bug reports for certain issues, even things I wouldn't consider security related.

Example, current Debian upstream guide states that packages need "a well-publicised preferred method for reporting security issues" and this is an item reviewed during requests for official inclusion in distributions such as RHEL or Ububtu-LTS.

there can't be a security vulnerability!

I mostly agree, but it's easier to "check the box" than to get an exception!

[johnsonjh]

Reopening as further clarification re: security is likely justified.

(I'll review after I get some sleep.)

[hayguen]

thanks for clarification.

my email [email protected] does also accept PGP:
the public key is on some keyservers; the fingerprint is 558E C9EF 3EAB 05E8 76AF 61DC D44C 9772 6FA1 CC0B
just in case, a 2nd email is useful

[johnsonjh]

Absolutely. I'll add your details, make a note about checking the keyservers as well, and then close this.

[hayguen]

ack

[johnsonjh]

@hayguen - should be acceptable now in HEAD, please reopen if you'd like anything else changed here.