View a list of pre-computed match suggestions #203

New issue

Closed

opened 2024-09-26 18:45:01 +00:00 by fricklerhandwerk · 3 comments

fricklerhandwerk commented

2024-09-26 18:45:01 +00:00

(Migrated from github.com)

As a security team member, I want to have an overview of untriaged CVEs, displayed as a priority list.

Each item in that list should only show the most relevant information:

CVE ID
CVE logline
Number of derivations affected
Number of channels affected

The list should be sorted by some reasonable combination of

CVE age
CVE severity
Relevance for Nixpkgs (e.g. number of supposedly affected derivations)
Confidence in the matching of CVE and Nixpkgs metadata

Depends on:

#221

As a security team member, I want to have an overview of untriaged CVEs, displayed as a priority list. Each item in that list should only show the most relevant information: - CVE ID - CVE logline - Number of derivations affected - Number of channels affected The list should be sorted by some reasonable combination of - CVE age - CVE severity - Relevance for Nixpkgs (e.g. number of supposedly affected derivations) - Confidence in the matching of CVE and Nixpkgs metadata Depends on: - #221

erictapen commented

2024-10-04 10:49:34 +00:00

(Migrated from github.com)

@fricklerhandwerk @RaitoBezarius and me discussed, that we will keep the concept of a match suggestion separate from a Nix security issue. That applies both to the internal model and how it's communicated to the user.

👍 1

erictapen commented

2024-10-08 15:09:52 +00:00

(Migrated from github.com)

The wireframes we want to work with for now. From now I'll focus on implementation, to see how this works with real data.

The wireframes we want to work with for now. From now I'll focus on implementation, to see how this works with real data. ![tmp yRLhZ2GsEM](https://github.com/user-attachments/assets/bc6fa432-de1f-4543-bc26-776bba181028) ![tmp 2jPHitPcr2](https://github.com/user-attachments/assets/118f79fe-d131-4e9b-9ab3-9c727fd44f09)

erictapen commented

2024-10-14 14:05:18 +00:00

(Migrated from github.com)

Provenance of how the match was created could be represented in some background colors of the relevant fields
https://github.com/Nix-Security-WG/nix-security-tracker/pull/282

Provenance of how the match was created could be represented in some background colors of the relevant fields https://github.com/Nix-Security-WG/nix-security-tracker/pull/282