[LDM #TXB-774930]: LDM Fortify Security Scan

Leo,

[I merged your latest email with your previous thread to keep things in one 
place. Hope you don't mind.]

> Full Name: Leo Rivard
> Email Address: address@hidden
> Organization: Air Force Weather Agency
> Package Version:
> Operating System:
> Hardware:
> Description of problem:
> 
> We are creating a sustainment plan for our NEXRAD system and I have
> been asked to follow up on a few questions.  I do understand that
> Unidata primarily works with institutions of learning.  As a contractor
> representing a government agency, I am instructed to ask the following
> so we can plan for and fund support of our system.

No worries. Dealing with the military is always a hoot because our cultures are 
so different. :-)

> First, is there a published schedule for LDM releases?  I have noticed
> that a new release comes out about every two months, but was asked to
> see if there is a more formal schedule.

Regrettably no. In an ideal world there would be a team of developers working 
on the code with a roadmap, milestones, burn-down charts, etc. In reality, less 
than one person works on the LDM (me) and much of my time is taken-up by other 
(often unpredictable) matters. I have moved the LDM codebase to GitHub 
<https://github.com/Unidata/LDM>, which has support some of these things -- 
though I've not made as much use of them as I (perhaps) should.

This could change if there was more funding (hint, hint :-).

> Second, I was asked to find out if there is a way to be automatically
> notified when a new release is ready for download.  All I have found on
> the Unidata website so far is the un-moderated address@hidden
> mailing list.

Announcements of new LDM releases are posted to the ldm-users mailing-list, so 
that's a good one to subscribe to. That list is also used by sites on our LDM 
network (called the IDD) for general inquiries (e.g., "I haven't received any 
GFS data. Is something wrong?"). In general, traffic is light (less than one 
message per week) unless and until NOAA has a problem and data doesn't flow. 
Then, there can be a half-dozen or so messages in the span of 15 minutes while 
the problem is diagnosed.

> Third, are there any other forums or mailing lists what the Air Force
> Weather Agency should be monitoring as far as LDM is concerned (e.g.,
> address@hidden).

"nws-changes" is a good mailing list for receiving notifications about changes 
to the stream of data put out by NOAA (e.g., changes in model type or 
resolution, radar upgrades, etc.). It's not so good for notifications about a 
problem with the flow of data. For that, I recommend "ldm-users" for an 
indication or confirmation of a problem, the website 
<http://www.nws.noaa.gov/noaaport/html/noaaport.shtml> for operational notices 
about the NOAAPORT broadcast, and the website 
<http://www.roc.noaa.gov/WSR88D/Level_II/Level2Info.aspx> for operational 
status of the NEXRAD Level 2 radars (which are carried on the IDD)

Also, the WMO bulletin of type "NOUS" is for operational notices from NOAA. 
Such bulletins are carried by NOAAPORT and can be extracted and processed by 
appropriate entries in the pqact(1) configuration-file of the LDM package.

The Unidata Program Center's website 
<http://www.unidata.ucar.edu/data/conduit/data_detail.html> has a good overview 
of the data on our IDD with links to the originating agencies.

> Thanks!
> 
> Leo

Anything new with the Fortify results?

Regards,
Steve Emmerson

Ticket Details
===================
Ticket ID: TXB-774930
Department: Support LDM
Priority: Normal
Status: Closed