Skip to content

Commit

Permalink
[DOCS] Remove bullet point on improving security over time. (#116980)
Browse files Browse the repository at this point in the history
Remove the 6th bullet point "Strive to improve security over time, for
example by adding additional testing, fuzzing and hardening after fixing
issues."

At the security group meeting on 2024-11-19 we discussed the role the
security group was performing in practice. We are in effect acting as a
security response group, dealing with issues raised via the process
given in the LLVM Security group page. We are not proactively adding
additional testing fuzzing and hardening. While this could be considered
an aspirational goal, it may give the implication that the LLVM Security
Group is handling or at worst guaranteeing security for the LLVM project
when in practice it is not.

Meeting notes:

https://discourse.llvm.org/t/llvm-security-group-public-sync-ups/62735/32
  • Loading branch information
smithp35 authored Dec 18, 2024
1 parent ccb66bf commit 0e324b3
Showing 1 changed file with 0 additions and 1 deletion.
1 change: 0 additions & 1 deletion llvm/docs/Security.rst
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ The LLVM Security Response Group has the following goals:
3. Allow distributors time to investigate and deploy fixes before wide dissemination of vulnerabilities or mitigation shortcomings.
4. Ensure timely notification and release to vendors who package and distribute LLVM-based toolchains and projects.
5. Ensure timely notification to users of LLVM-based toolchains whose compiled code is security-sensitive, through the `CVE process`_.
6. Strive to improve security over time, for example by adding additional testing, fuzzing, and hardening after fixing issues.

*Note*: these goals ensure timely action, provide disclosure timing when issues are reported, and respect vendors' / packagers' / users' constraints.

Expand Down

0 comments on commit 0e324b3

Please sign in to comment.