Once a rare occurrence a decade ago, security advisories are now produced many times a day. For each one, there are multiple other companion advisories or commentaries produced in response, and each of those have slightly different information from different sources, are produced or collected at different times, and are written in different styles with different ultimate goals.
Is it any wonder that we are confused? And we are the experts!
The existing state of the art is complex and so are the products, but the goal of this hands-on class is simple: Find the common elements of advisory construction that are _good_, eliminate the _bad_, and develop a framework for producing better future advisories.
Estimated time: 3 hrs (afternoon session)
Format: The class will be consensus-led. The instructor will provide background and examples, propose one or more vulnerabilities to study, encourage discussion, and collate material contributed by the participants. Attendees are expected to contribute to discussion and commentary,
identify desirable and undesirable elements of advisories, compose (or help with composing) sections of text as a result of what has been
learned, and then develop rules for ensuring better content in future security advisories.
Laptops are recommended highly but are not required; pen and paper will be adequate. Attendees will compose some sections separately at the same time to compare with others, and at other times attendees will work in parallel on different sections of an advisory to be collated by the instructor.
Experience with more than one language will be valuable but is not required.
March 2, 2007 13:30-15:30, March 2, 2007 16:00-17:00
