[Soc-coordination] Deciding on our applications

[Erich Schubert]

Hi,
I've read through the various "security checking" proposals.
I put one into the ineligible section, it didn't have any real content,
so don't be surprised if counts don't match up anymore.
I'd count the OVAL project to the security checking proposals; I'm aware
that they have a different focus (and it might make sense to take one of
each), but they also are somewhat related.
Javier, I'd like to talk to you about the OVAL thing, how much of it's
testing etc. should be resusable/shared with a checksecurity rewrite, or
how these projects are related to each other.
I could imagine that checksecurity could also process OVAL data provided
by Debian on the security website etc. (am I right that Debian could use
OVAL as a language to publish which package versions are affected by a
certain vulnerability?)
One proposal mentioned SELinux. It would make a lot of sense to
integrate some SELinux support into checksecurity and similar
applications (e.g. checking if a daemon is running in the domain it is
expected to on SELinux systems, to ensure that the SELinux protections
are actually in use, especially for targeted policy)
A larger project would be to do a targeted policy extension where a HIDS
is actually protected from the root user, too. This needs some thorough
planning however, since we'd also want to prevent the root user from
being able to block off alerts etc., but on the other hand he should be
able to do upgrades and maybe reboots...
However I'm not convinced that proposal had a clear idea on what to do
for the project or how this could be integrated with SELinux, thats why
I have removed myself as mentor again. Once we've decided which
applications are interesting, we can talk about mentoring/co-mentoring
again.

I've also forwarded the 'recommender tool' application to Enrico; he
won't sign up with Google because he doesn't trust them and their
policies. However he has done some related work. Maybe I'll be the
official mentor for this project then, and Enrico will co-mentor it.

best regards,
Erich Schubert
-- 
    erich@(vitavonni.de|debian.org)    --    GPG Key ID: 4B3A135C     (o_
 The early bird gets the worm, but the second mouse gets the cheese.  //\
  Wie kann ich wissen, was ich denke, bevor ich höre, was ich sage.   V_/_