Hi everyone
Thanks for raising this, and I’m really sorry we dropped the ball here. There have been multiple failures on our part that have led to a situation that falls well short of our standards.
- Recommending Docker usage without the Ghost core team maintaining the Docker image
- Releasing a security update without providing an update path via the recommended Docker image
- Releasing a security disclosure without there being sufficient time for anyone to update
- Sending a confusingly formatted, unhelpful security update notification by email
I want to own and acknowledge that this is not good enough, and I want to share what we’re doing about it:
First - until now, our developer tooling and release process has been a shared responsibility between our engineering teams. That worked fine for a long time while Ghost was smaller, but it no longer works, today. The surface area is too large, and it needs to be someone’s fulltime job.
As a result, we’re immediately hiring for (two) fulltime platform engineering positions. If you know anyone who might be a good fit, please send them our way.
Second - the Ghost Docker image will become the official first-class way to run Ghost, and it will be supported, maintained, and released by the Ghost core team. That will be one of the first projects we ask new platform engineers to work on.
It’s not going to happen overnight, it will take some time, but we will get it done.
Until we complete that transition, we will coordinate any future security releases and make sure there is a Docker upgrade path immediately available - and that the disclosure of security issues is better communicated, with time to complete updates before publishing the details of the issue.
We’ve made (and will continue to make) changes to our incident response and security release processes to do better, and make sure we don’t repeat the same mistakes in the way we have here.
The responsibility for this lies squarely with me. I haven’t done a good job of prioritizing this work and the resources needed to do it.
I’m going to put that right.