{"action":"created","issue":{"url":"https://api.github.com/repos/Entware/entware/issues/114","labels_url":"https://api.github.com/repos/Entware/entware/issues/114/labels{/name}","comments_url":"https://api.github.com/repos/Entware/entware/issues/114/comments","events_url":"https://api.github.com/repos/Entware/entware/issues/114/events","html_url":"https://github.com/Entware/entware/issues/114","id":56143921,"number":114,"title":"Need to shorten the time to apply/pickup security patches","user":{"login":"YasharF","id":6448697,"avatar_url":"https://avatars.githubusercontent.com/u/6448697?v=3","gravatar_id":"","url":"https://api.github.com/users/YasharF","html_url":"https://github.com/YasharF","followers_url":"https://api.github.com/users/YasharF/followers","following_url":"https://api.github.com/users/YasharF/following{/other_user}","gists_url":"https://api.github.com/users/YasharF/gists{/gist_id}","starred_url":"https://api.github.com/users/YasharF/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/YasharF/subscriptions","organizations_url":"https://api.github.com/users/YasharF/orgs","repos_url":"https://api.github.com/users/YasharF/repos","events_url":"https://api.github.com/users/YasharF/events{/privacy}","received_events_url":"https://api.github.com/users/YasharF/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Entware/entware/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-01-31T23:20:19Z","updated_at":"2015-03-10T18:56:20Z","closed_at":"2015-03-10T18:56:20Z","body":"Today, most Entware packages pickup security patches when 1) OpenWRT trunk has the patch imported in its code base, and 2) The \"monthly\" sync from the OpenWRT trunk is done. (Last two syncs were on Oct 18, Dec 15; today is Jan 31 and there hasn't been a sync since Dec 18).\r\n\r\nWhen I reviewed the last few security patches in OpenWRT, I noticed they got patched in the trunk within about a day or so after the issue was disclosed. I can also add that from my past experience, there have been cases where active exploitation of security vulnerabilities by malicious agents started within 2 hours after disclosure of the vulnerability, and many organizations have a 48 hour requirement for disclosure-to-patched-system deadline.\r\n\r\nI propose that we improve the release process to enable users to patch their devices earlier to reduce chances of device compromise or other impact.\r\n"},"comment":{"url":"https://api.github.com/repos/Entware/entware/issues/comments/78122615","html_url":"https://github.com/Entware/entware/issues/114#issuecomment-78122615","issue_url":"https://api.github.com/repos/Entware/entware/issues/114","id":78122615,"user":{"login":"ryzhovau","id":1623091,"avatar_url":"https://avatars.githubusercontent.com/u/1623091?v=3","gravatar_id":"","url":"https://api.github.com/users/ryzhovau","html_url":"https://github.com/ryzhovau","followers_url":"https://api.github.com/users/ryzhovau/followers","following_url":"https://api.github.com/users/ryzhovau/following{/other_user}","gists_url":"https://api.github.com/users/ryzhovau/gists{/gist_id}","starred_url":"https://api.github.com/users/ryzhovau/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ryzhovau/subscriptions","organizations_url":"https://api.github.com/users/ryzhovau/orgs","repos_url":"https://api.github.com/users/ryzhovau/repos","events_url":"https://api.github.com/users/ryzhovau/events{/privacy}","received_events_url":"https://api.github.com/users/ryzhovau/received_events","type":"User","site_admin":false},"created_at":"2015-03-10T18:56:20Z","updated_at":"2015-03-10T18:56:20Z","body":"No response, closing for now."}}