envoyproxy/envoy

Periodic testing of envoy-security@googlegroups.com

Open

#6,590 opened on Apr 15, 2019

View on GitHub
 (0 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
area/securityhelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

We should periodically verify that a report filed to envoy-security@googlegroups.com makes its way past e-mail filters/redirects etc. to a human being in the Envoy security team. This is motivated by the wish to avoid something like https://github.com/nodejs/security-wg/issues/454#issuecomment-481919759 occurring and the blackholing of vulnerability reports.

Action item for CVE-2019-9900

Contributor guide

Research direction
Create a periodic test to send an email to envoy security@googlegroups.com and verify it reaches a human. This involves setting up a cron job or CI job that sends a test message and then checks for an acknowledgment.
Tech stack
None
Domain
security
Issue type
Chore
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
1
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
None
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40