The recent SA-CORE-2018-004 and SA-CORE-2018-002 security advisories have sparked a lot of conversations in the Drupal community regarding all things security. IMHO, it's important to highlight several talking points to keep things in perspective.
1/Timing. In both cases, it is believed that the patches and releases occurred before any publicly known or widely used exploit. This is huge. This means the community had a marked advantage in addressing before mass exploits were attempted.
2/Responsible Disclosure. Individuals finding these vulnerabilities decided to work with the Drupal Security team rather than disclose publicly. This is huge. It allows the community the chance to address proactively versus reactively on a potential 0-day exploit.
3/Due Diligence. If you'll note on SA-CORE-2018-004, there were members of the security team that played a part in the additional research and testing. To me this highlights the team taking active measures versus waiting passively for external reports.
4/Level of Participation. Despite being a group of volunteers, you'll note that a dozen individuals helped fix and coordinate this issue. This is a non-trivial amount of eyeballs looking at the problem and effort spent reviewing/evaluating the remediation strategy.
5/Hard Decisions w/Level Headedness. While we would all like security releases to fit within nice timeboxes that minimize disruption, the team sometimes has to balance risk with factors like convenience and maximizing overall benefit to the community. This is not easy/trivial.
6/Hosting Providers. While it only represents a fraction of the overall Drupal install base, the fact that several key hosting providers quickly rolled out infrastructure-level protection significantly limited the overall exposure.
7/Feedback Loops. While not all details can be disclosed, anyone on the public side can clearly see that the security team has been taking and applying feedback on a regular basis to improve communication/releases of critical/highly critical issues.
8/Real Time Support. While it remains to be seen if it stays open, there was a Slack channel opened up for real-time questions/answers drupal.slack.com/messages/C2AAK….
9/Volunteers. An important reminder that many members of the Drupal Security team are volunteers. Appreciation can go a long way. Even better, if you're a company that employs a Drupal Security team member, allocating more company time would be well received.
10/Open Source. Security Advisories are not a bug, but a feature of open source. The codebase (like our community) is a shared responsibility.
End thread. Thank you for listening.
