Skip to content

Ruby Central: Update September 2024 #422

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 7, 2024
Merged

Ruby Central: Update September 2024 #422

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions alpha/engagements/2024/RubyCentral/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ This engagement started in February 2024.
* [May 2024](update-2024-05.md)
* [June 2024](update-2024-06.md)
* [July 2024](update-2024-07.md)
* [August 2024](update-2024-08.md)
* [September 2024](update-2024-09.md)

### Primary Contacts

Expand Down
43 changes: 43 additions & 0 deletions alpha/engagements/2024/RubyCentral/update-2024-09.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
# Update 2024-09

## Organizations

We are making steady progress and continue to aim for the end of November to have the feature ready for users.

### Maintainer Role

* Maintainer role code is ready to merge pending documentation for using the featuer.
* We will publish the feature along with the documentation when both are ready.

### Organizations

* The onboarding model, supporting a user to create an organization, is in progress.
* As we work on implementing the details of the onboarding process, we are working through some of the implications of the design.
* The organization designs are partially implemented on the site.
* The organization designs incorporate our new design templates and add highly requested features like dark mode and an improved user interface that highlights more important information.
* We will begin rolling out the new design template with the organizations feature.

### Next steps:

* Finish the pages for viewing an organization.
* Continue work on the onboarding process and ability to edit and manage the organization.
* Start adding test users once the permission system and organization pages are ready.

## Audit

The audit is completed and the draft report was delivered September 9th, 2024.

* We have reviewed the report with the Trail of Bits team.
* The report details 33 findings, mostly low severity or informational.
* 7 findings were considered medium severity, and 1 finding was labeled high severity.
* Samuel and the rest of the team have taken the findings and are responding with fixes and/or explanations that explain why a fix is not necessary.

One important finding of this audit is that our effort to continue to convert our infrastructure to Terraform would pay large dividends in security.
However, this project is a large undertaking that will require a larger monetary and time investment above and beyond the baseline maintenance supported by our current funding.

### Next steps:

* Addressable security concerns will be remediated and fixes deployed.
* A response document is being drafted that responds to each finding.
* When we are ready to mark each of the items as complete, we will contract with ToB for a further fix review.
* After the fix review is incorporated into the report, we will coordinate with ToB to publish the report.
Loading