rubysec / rubysec.github.io Goto Github PK

Per rubysec/rubysec.com#14, it'd be cool and useful if we could offer folks an rss feed so they could consume the data in other ways.

I recently became adept with generating static gh-pages from actions, so should anyone want to write a script that generates an atom/rss feed given the contents of the ruby-advisory-db, I'd be happy to string that into a GitHub action.

Most gems don't have any set process/policy for handling security vulnerabilities. We should provide a basic template for them to use to make it easier for them to draft one and get it published.

ruby-doc.org is going to list Ruby related advisories. We should also have a blog where we announce new advisories.

Simplify how ruby-advisory-db is imported and converted into pages. Instead of converting the YAML files into Markdown, simply inline the YAML into the Jekyll "front matter" and add layout: advisory. This will allow the actual conversion to be done by _layouts/advisory.html.

Many of the vulnerability descriptions are written in markdown.

We should render it as such (especially code snippets)

This repository only contains the generated master branch. What happened to the source branch, i.e. the master branch in @tarcieri 's fork?

Document the steps to report a vulnerability.

1. OSVDB: email [email protected] and/or message @osvdb on GitHub or Twitter.
2. Request a CVE from oss-sec mailing list or reserve a CVE from MITRE.
3. Once OSVDB or CVE have been obtained, send advisory to [email protected].

Add a template for Advisories, based off of the standard Rails Security advisory.

What happened to rubysec.com? This repo no longer represents https://rubysec.com/?

I had been following the previous atom feed at https://rubysec.com/atom.xml, and aggregating it on http://rubyland.news. Is there a replacement atom or rss feed?