What can we do to improve security on a general level?

[spoenemann]

The OCT project team recently proposed to move this project to the Eclipse Foundation – you can read the full proposal here. One of the reasons for this move is to take advantage of the foundation's experience regarding security aspects. We welcome any kind of support for improving the overall security of OCT.

@mbarbero could you give us a few pointers where we could start the journey to better security for this open source project?

CC @msujew @kineticsquid

[mbarbero]

Hi Miro, sorry for the delayed response, this notification got lost in my inbox.

We have some initial material in the Security Handbook and in our specifications of levels for better supply chain security. Both documents are still a work in progress, so feel free to open issues on their respective repositories or ask more general questions at the GH organization level. FYI, there’s already a discussion thread about the security levels document. HTH

[spoenemann]

Thanks, we'll have a look!