potential new SHOULD criteria for metal badging to cover periodic review of vulnerability report mailing list membership.

[TonyLHansen]

A project recently had a a vulnerability reported in their code. The project had a process in place for both how to file a private ticket and how to send a private message to a security review board within the project. However, the process broke down in a couple fashions:

The mailing list to which such reports were sent was

• owned by a person who had left the company that sponsored the mailing lists, and
• there were people on the list who had not been involved in the project for a few years.

I'm proposing a SHOULD item to be added to the badging somewhere (e.g., in gold level) that says:

"Any mailing list that is associated with vulnerability reports SHOULD have periodic, automated reviews to look for members or owners of the mailing list who are no longer associated with the project or company."

Additional wording might be applicability as to the frequency of review (e.g., yearly). An open area of discussion might be whether it is acceptable for the automated process can simply be a calendar reminder to do a manual review.

[toine-at-est]

Hi Tony, good suggestion but I do want to consider the option of a manual review process as the that might be more feasibly. You already suggest at the end that a yearly reminder to for a manual review might be good enough.