11 May
2026
11 May
'26
3:09 a.m.
I second what Thilo says here. What would be the expected work and
regular effort?
Some more questions and thoughts:
When do we see the XSF as CNA successful, when not? For example what
means 'slow' currently?
I remember Georg (?) intended years ago to list more of the present
CVEs. How much of this this come close to what is expected here? See
also this:
https://xmpp.org/community/security-notices/
https://github.com/xsf/xmpp.org/tree/master/content/community/security-noti…
If we start being a CNA, would that actually trigger "more" CVEs being
reported? (--> growing effort?)
Would we achieve new options and opportunities as organization being an CNA?
Cheers,
Eddie
On 07/05/2026 21:12, Thilo Molitor wrote:
Well, I like the idea and would volunteer, but I don't understand what the
workload would be either, so maybe I don't. I think some insights by people
that actually did CNA work would be *very* helpful and most appreciated.
-tmolitor
Agreed. The minimal feedback so far implies to me that
there isn't
significant interest in this proposal or in forming such a team.
I certainly have interest in the XSF being a CNA. I think XMPP projects I'm
involved in would appreciate it and use it. (I've not actually asked Guus
about Openfire, but I would be keen, certainly).
I'm not yet convinced there are enough people willing to do the work -
indeed, I'm not sure I understand what the workload would be, yet, much
less commit to it myself.