Improving the FreeBSD security advisory process
summary
FreeBSD acknowledges slow historic security response and now formalizes reporting via a PGP-encrypted security officer address, a bug tracker and fortnightly calls, plus shell-script automation for advisory steps. The project splits triage from fixes, delegates to domain experts among ~400 committers, and uses the FreeBSD Foundation to sign NDAs and fund a full-time fixer (caustic). The ports tree exceeds >38,000 ports; the new process manages multi-vendor embargoes and even published within an hour for an Intel debug-register advisory.
AI-written summary · about
chapters (13)
- 0:00Start
- 0:44What is FreeBSD?
- 1:38Who uses FreeBSD?
- 2:42Where FreeBSD excels
- 4:02Where FreeBSD (historically) doesn't excel
- 4:27Large and diverse code base
- 6:32Vulnerability response
- 9:21Security officer charter
- 12:17Challenges facing the security team
- 12:47Results of challenges
- 13:36How we are fixing it
- 15:12FreeBSD Foundation involvement
- 16:36Case study: CVE-2018-8897 / SA-18:06.debugreg
related talks
43mFunding Security in Open Source: Insights From FreeBSD’s Audit Journ...
39mSecurity Advisory Programs: Creating Transparency Along the Software Supply Chain
49mImproving FOSS Security
19mCommunity-led Security at ASF
41mFreeBSD: Code, Community and Collaboration
47mImproving the Security of a Large Open Source Project One Step at a Time
48mImproving the Security of a Large Open Source Project One Step at a Time
31mA Glimpse Into OSS Vulnerability Disclosure Practices