Every software platform eventually deals with serious vulnerabilities.

So when evaluating a platform's security, I don't think "Has this software ever had a serious vulnerability?" is a particularly useful question.

A better question is: What happens when one is found?

I started thinking about this after reading about the recent Citrix NetScaler zero-day. It also got me thinking about something Drupal has built specifically for that uncomfortable period between disclosure of a critical vulnerability and getting the actual patch deployed: Drupal Steward.

For certain highly critical, mass-exploitable vulnerabilities, Steward can provide network-level protection while organizations test and deploy the software update. It doesn't replace patching, but it can make that "patch gap" less dangerous.

I dug into Steward, Drupal's coordinated security process, and why I think the response to vulnerabilities tells us more about a platform's security than the existence of vulnerabilities themselves:

Zero-Days Happen. What Matters Is What Happens Next.

I'm especially curious: who here is actually using Drupal Steward? What's your experience been with it?

Hey everyone.

When I took over r/Drupal quite a few years ago now, it was basically dead. It took time but it’s built itself up to be a resource many have turned to over that time. From our community AMA days to people finding support, people found something here.

I lost my employment end of last year and have had almost no luck finding a new position. This has caused me to start seriously considering my future in the industry over the next while.

So, I am looking to have someone from the community to take over r/Drupal and help guide it into the future.

If you or your organization would like to take over this sub send me a mod mail or direct chat and tell me why you’d like to take it over and how you would help move the mission of Drupal forward.

I am not looking to give it away to just anyone. I want to keep the spirit of Drupal and what made it special (its community) here on Reddit.

Thank you all for being part of this amazing journey so far.

(I wouldn’t refuse job offers too but that’s not the point of this sub, of course ;) )