I second what Thilo says here. What would be the expected work and regular effort? Some more questions and thoughts: When do we see the XSF as CNA successful, when not? For example what means 'slow' currently? I remember Georg (?) intended years ago to list more of the present CVEs. How much of this this come close to what is expected here? See also this: https://xmpp.org/community/security-notices/ https://github.com/xsf/xmpp.org/tree/master/content/community/security-notic... If we start being a CNA, would that actually trigger "more" CVEs being reported? (--> growing effort?) Would we achieve new options and opportunities as organization being an CNA? Cheers, Eddie On 07/05/2026 21:12, Thilo Molitor wrote:
Agreed. The minimal feedback so far implies to me that there isn't significant interest in this proposal or in forming such a team.
I certainly have interest in the XSF being a CNA. I think XMPP projects I'm involved in would appreciate it and use it. (I've not actually asked Guus about Openfire, but I would be keen, certainly).
I'm not yet convinced there are enough people willing to do the work - indeed, I'm not sure I understand what the workload would be, yet, much less commit to it myself.
Well, I like the idea and would volunteer, but I don't understand what the workload would be either, so maybe I don't. I think some insights by people that actually did CNA work would be *very* helpful and most appreciated.
-tmolitor