Create system for distributing pre-announcements of extreme security issues in core/contrib

I propose that the goal should be expanded to be about improving security knowledge as it relates to a particular site.

Consider the issue at #2369383: Provide basic SA details in 'security update available' message which asks for detailed SA data within security update messages. The mechanism for alerting pre-announcements could piggyback on a system that shows expanded SA details, given shared development.

Hi,

I think that the pre-announcement functionality doesn't have to be more complex than it has to be:

In the rear case that the sec team thinks that a pre-announcement is needed (pre-auth remote exploit or something critical enough), all that we need IMO is to spread the word that a new highly critical security advisory + new release will be published on yyyy-mm-dd at hh:mm UTC.

• This announcement would then be published as a special content type on d.o that the sites can poll when cron is run.
• The pre-announcement doesn't have to tell which contrib module is affected (see below for my 2 cents). All we have to tell at this point is the major version(s) that are affected and the timestamp when the fix will be released.
• The update module would then show the red hilight + send an email to the site owner if the email alerts are enabled on update module settings
• Obviously, the pre-announcement should also be sent to the official sec mailing list as well

I would say that this functionality would be all that is needed. I don't like the idea that the pre-announcement would include the affected contrib module name because this would give unnecessary heads up for the attackers to find the sechole before we have the fix available. There are some extremely widely used modules which are still small in terms of the amount of code so publishing the name of the module might already be too much information that we want to publish.

Let's not over engineer this one. I think that the only thing that we are trying to solve with the pre-announcements is to make sure that as many site maintainers would get the alert in time so that they can plan their schedules so that they are prepared when the SA is released.

Cheers,
Markus

I like a lot this idea.

Could we add to this pre-announcement information about how to protect yourself (if possible)

Taking as example this Security Pre-announcement of Typo3:

Please consider deactivating "register_globals"; this setting is deprecated
nowadays (PHP 5.3+) and is generally not needed for TYPO3.

I like this idea, I think it would be good to be able to add multiple users to the email string for the SA message.

For example you may have a sites email as: webmaster@example.com, but your devs is/are dev1@example.com/dev2@example.com. Webmaster might not be checked as often, but this would allow for the devs to be aware of it.

Just an idea.

This feature would have to be forced as always enabled to be really effective, so it can't depend on the 'update' module, because this module can be disabled on production sites. But it is probably obvious already.

Agree strongly with #5 that the pre-announcement must include information about how to protect yourself. In the case of SA-CORE-2014-005, hackers would have already have identified thousands or millions of potential victim Drupal sites and had all their botnets primed, it would only have taken them a minute or two to engineer their attacks and start deploying them. How many site admins could have patched or upgraded all their sites in a time window of a few minutes?

In this case AFAICS the only protection would have been for all Drupal 7 sites in existence to be taken completely offline manually before the details of the vulnerability were revealed.

[Update] though one has to wonder, if a vulnerability is rated at the most critical level, would hackers have reasoned ... the vulnerability must be in database.inc...... and would they have found it......

FYI: This is nearing completion at #3041885: Display relevant Security Advisories data for Drupal

This very much seems like a duplicate of #3041885: Display relevant Security Advisories data for Drupal, so closing this out.