122 The Drupal Security Team With Greg Knaddison and Michael Hess - Modules Unraveled Podcast

## The Drupal Security Team
* What type of people are on the Drupal Security Team?
    * https://security.drupal.org/team-members
    * Mostly coders, some project managers, core maintainers
* What does the security team do?
    * We fix issues in drupal
    * Resolve reported security issues in a Security Advisory
    * Provide assistance for contributed module maintainers in resolving security issues
    * Provide documentation on how to write secure code
    * Provide documentation on securing your site
    * Help the infrastructure team to keep the drupal.org infrastructure secure
* What doesn’t the security team do
    * projects without stable releases
    * Site support
    * Set policy around security with the security working group.
* Is there a D7 security team and a D8 security team with different people? (What about Drupal 6)
* How can others get involved?
* What was the recent bug that was fixed
 
## Questions from Twitter
* [Paulius Pazdrazdys](http://www.twitter.com/Paulenas)
How this latest security release is different from others? Do you have any information if this bug done any harm before release? #MUP122
* aboros @hunaboros
The recent bug was über critical, still only 20/25. What would be a 25/25 bug? #MUP122
* [aboros](http://www.twitter.com/hunaboros)
Do you notify any high value targets before SA is sent out? Is the list of those public? Can one be part of this privileged group? #MUP122
* [Carie Fisher](http://www.twitter.com/cariefisher)
When the latest bug was found? is there a private drupal security group where this was discussed? could we have found out sooner? #MUP122
* [David Hernandez](http://www.twitter.com/davidnarrabilis)
#MUP122 What is the average time from discovery to announcement?
* [Damien McKenna](http://www.twitter.com/DamienMcKenna)
@ModsUnraveled #MUP122 Are there existing stats on how long it takes from initial reporting, to maintainer response, to first patch & fix?
* [Heine Deelstra](http://www.twitter.com/Ustima)
How was SA-CORE-005 (in hindsight) able to be public for so long in the public queue? #MUP122
* [Mark Conroy](http://www.twitter.com/markconroy)
I think the #drupal security team are great. Working extremely hard. (I know, that wasn't a question) #MUP122
* [aboros](http://www.twitter.com/hunaboros)
Are there plans for some sort of bounty program run by DA maybe? #MUP122
* [David Hernandez](http://www.twitter.com/davidnarrabilis)
#MUP122 What kind of work does the security team do besides review code? What is the administrative overhead?