Re: [RFC] Adding a SECURITY policy for GDB

[Andrew Burgess <aburgess@redhat.com>]

Siddhesh Poyarekar <siddhesh@redhat.com> writes:

> On 2024-02-12 11:43, Guinevere Larsen wrote:
>> On 08/12/2023 16:05, Andrew Burgess wrote:
>>> One last thing, while writing this, I did wonder if this text would be
>>> better moved into the GDB manual, and the gdb/SECURITY.txt document
>>> should just say "See the GDB manual", but I figure that's a problem for
>>> future me, for now I just need to find some words we can all agree on.
>>>
>>> Thanks,
>>> Andrew
>> 
>> Would it be possible to do the opposite and have the docs pull from the 
>> txt document? I like the idea of having specific files that are easy to 
>> check as a developer or end user, and I think having a file that says 
>> "look at that other file" that contains everything GDB (and thus makes 
>> it harder to quickly find what you're looking for) would muddle that a 
>> little bit.
>
> Not to mention the fact that $topsrcdir/SECURITY* is the first place 
> where people tend to look to report potential security issues.  This is 
> similar in principle to "Reporting bugs"; the manual is usually the last 
> place one would look, although it makes sense to *also* put it in the 
> manual.
>

Which is why the SECURITY* file would redirect to the definitive text.

But this feels like a future problem.  First we need to reach consensus
on some actual words.

Thanks,
Andrew