how to get information about security updates

[zmi]

I see that you have twitter, an announcement board, etc. to provide information about CiviCRM. But I could not find out if there's such a thing for security updates? We are an ISP, and we can't follow all the forums for all software, so we really need to subscribe to a mailing list where information about security implications is provided, so we can tell that to our customers or fix it for them if they want (=pay for it). Can someone help me here?

[Donald Lobo]

Sorry, we do announcement via our blog and forum mailing list only. All folks with an account on the forum get that email (unlss they've opted out)

We are in the process of migrating the forum mailing list to a civimail mailing list, but its more on a long term basis. Once we do that, we'll consider doing a security mailing list

lobo

[Michael McAndrew]

Hey there,

Agree this is important and will try and get it set up in the new as as per lobo's suggestion - if you have energy to help with that (sounds like it is in your interest) please ping me.

Michael

[zmi]

Agree this is important and will try and get it set up in the new as as per lobo's suggestion - if you have energy to help with that (sounds like it is in your interest) please ping me.

We are an ISP, I could offer a mailing list running on our hosts if you want. We use mailman for that. Is that helpful?

[Michael McAndrew]

Thanks a lot for the offer

We have the infrastructure to send out the maiiings.  What we are missing is the proceedure and a person to implement the proceedure.  Are you interested in helping out with that?

[zmi]

That would involve learning to understand your internals, so it would take me a lot of time "just" to have a mail about security updates. That's a little too much work for me, sorry.

But it shouldn't be a lot of work for you, right? You already have the announcements via blog & forum, so it's just a matter of sending it via e-mail too. It "just" has to be filtered so no feature announcements are sent, only security stuff. Don't know if you have that already? Maybe this is what you meant. The typo3 project has a nice security info ecosystem, maybe they can help or give ideas about the missing things?

[Michael McAndrew]

Agree that it shoudn't be too hard for us.  I'll get started on it in the new year

[Coleman Watts]

One more thought - currently we do an automatic check and alert the admin if a new release is available, but it does not distinguish between normal and security releases. Can we think about how to do that?

[zmi]

For the beginning, receiving notification mail on all updates is better than nothing. But it would be nice if I could limit that to security updates only.

[Chris Burgess]

Well, now you can

CiviCRM security updates group is @ https://civicrm.org/advisory/subscribe - add your email there.

[jimcorbett]

You can easily update from a weekly updates of CiviCRM. no need to do that on a daily basis.