INSTALL.txt could link to security documentation resources [#218539]

The security team is getting a number of public statements about the perceived quality of Drupal security. Part of this is due to closed nature of security work. Part of this is due to focus on creating security patches, and not enough effort on outbound security education. One complaint is that security is not displayed prominently both on Drupal.org and in the Drupal software.

I'd like to request that we include one of two links to Drupal 6.

http://drupal.org/node/213320 - My Site Was Defaced ("hacked"), What Should I do Now?
http://drupal.org/node/101494 - HOWTO: Report a security issue

One possibility would be here: admin/reports/updates

Note, I am only suggesting a text interface change, to help educate users about Drupal security and hold off a perception about Drupal's security. Let me know where you think the appropriate place to have a link to security resources is, and I'll try to get a patch in.

Comment	File	Size	Author
#10	for_more_information_3.patch	1.37 KB	keith.smith
#10
#8	for_more_information_2.patch	1.31 KB	keith.smith
#8
#7	for_more_information.patch	1.31 KB	keith.smith
#7

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

greggles

he/him

English

Denver, Colorado, USA

CreditAttribution: greggles commented 6 February 2008 at 17:10

I suggest we move this to the README.txt or to 7.x. I think it's too late for 6.x.

Comment #2

Amazon CreditAttribution: Amazon commented 6 February 2008 at 17:15

Of course, the interface has already been translated to many languages.

README is the next logical place.

Thanks for pointing this out.

Comment #3

dww

we/he/they

CreditAttribution: dww commented 6 February 2008 at 17:16

Title:	Update system could link to security documentation resources	» Update status could link to security documentation resources
Version:	6.0-rc3	» 6.x-dev
Component:	update system	» update.module

admin/reports/updates is from the "update.module". confusingly, the "update system" refers to update.php and the DB update system. i've always been uneasy about this name collision ever since i was told to strip the "_status" part out of the module when it moved into core. oh well.

anyway, i'm not sure this is really the best place for such links. this page is already rather busy as it is, and i doubt most people will pay attention to those things buried in the help text.

and, as a string breaker on the eve of a release, this seems destined for being postponed, even if we wave the "security" trump card in the air a few times...

that said, #213320 seems like a bad title to put in the Drupal admin UI. ;) I'd be more comfortable linking to #101494 I think. Probably this will just get moved to 7.x-dev, but I'll leave it at 6.x-dev for now.

Comment #5

dww

we/he/they

CreditAttribution: dww commented 6 February 2008 at 18:34

Title:	Update system could link to security documentation resources	» README.txt could link to security documentation resources
Version:	6.0-rc3	» 6.x-dev
Component:	update system	» documentation

Looks like we all agree this isn't going to happen in update.module. There's still hope of getting this into the README.txt if someone's so inspired...

Comment #6

keith.smith CreditAttribution: keith.smith commented 6 February 2008 at 18:42

Title:

README.txt could link to security documentation resources

» INSTALL.txt could link to security documentation resources

Note that there is no README.txt, but INSTALL.txt would work.

Comment #7

keith.smith CreditAttribution: keith.smith commented 6 February 2008 at 19:52

Status:

Active

» Needs review

File	Size
for_more_information.patch	1.31 KB

First draft attempt at adding some "For more information" security references in the "MORE INFORMATION" section of INSTALL.txt.

Comment #8

keith.smith CreditAttribution: keith.smith commented 6 February 2008 at 19:54

File	Size
for_more_information_2.patch	1.31 KB

Er. Now with an extra comma.

Comment #9

dww

we/he/they

CreditAttribution: dww commented 6 February 2008 at 20:10

Status:

Needs review

» Needs work

Great, thanks.

However, this seems not ideal:

- For a list of security announcements, see the "Security announcements" page
  at http://drupal.org/security or subscribe to drupal.org's "Security
  announcements" mailing list or RSS feed.

It doesn't say how to subscribe to those things, and the "Security announcements" mailing list isn't really a mailing list per-se.

How about something like this:

- For a list of security announcements, see the "Security announcements" page
  at http://drupal.org/security (available as an RSS feed). This page also
  describes how to subscribe to these announcements via e-mail.