[SINGA-417] Adding security channel

• Type: New Feature
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Component/s: Documentation
• Assignee: Unassigned
• Reporter: Moaz Reyad
• Created: 08/Dec/18 17:28
• Updated: 29/May/19 15:13
• Resolved: 12/Dec/18 09:33

Description

According to the Apache Project Maturity Model:

QU30: The project provides a well-documented, secure and private channel to report security issues, along with a documented way of responding to them.

Apache projects can just point to http://www.apache.org/security/ or use their own security contacts page, which should also point to that.

This issue can be solved simply by adding a link to Apache Security page to SINGA website.

However, I would also suggest to :

1. create a sub team in SINGA (even starting with one person) for security
2. ask for an email [e-mail] for project security contacts
3. create a new page for security in SINGA website
4. add SINGA security team (page and email) to ASF Project Security Information page

Machine learning systems like SINGA may work with sensitive data (e.g. medical data, finance, etc.) and SINGA provides distributed training where data and models can be shared in a network. If SINGA security team provides details to ensure the best security practices, this can be an important feature to show in SINGA now or in a future release.

Issue Links

• blocks: SINGA-405 Graduate Apache SINGA (incubating) as a TLP