[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160213141513.06096f21@pc1>
Date: Sat, 13 Feb 2016 14:15:13 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: Thoughts about security of Linux distributor
collaboration platforms, bugtrackers for opensource software
On Sat, 13 Feb 2016 05:52:44 +0000
halfdog <me@...fdog.net> wrote:
> Hence really critical security material perhaps should not go to such
> platforms, e.g. Ubuntu Launchpad, or the platform should be modified
> to send security issues only in encrypted mails without talkative
> title, members without mail public key registered should get only
> message "Bug [Number]: Info changed" including the HTTPS link to the
> issue in the platform.
This is roughly what mozilla does and I like it a lot. They have a bug
tracker over https and you can add a PGP key. If you don't add a PGP
key and report a security bug you won't get updates via mail
unencrypted.
I think this is definitely an area that could need improvement. A lot
of projects don't have any reasonable way to securely report bugs. And
some actively discourage reporting bgus in a secure way (apache has
some note on their webpage that you may send your reports encrypted to
some people, but have to expect longer delays if you do so instead of
using the "normal" unencrypted way).
One problem is also that e.g. the github bugtracker (and I think many
other bugtrackers as well) doesn't consider sensitive bug reports.
But I also agree with Florian: Part of the problem can be mitigated by
not keeping things under the hood for too long. I'm often disappointed
with slow reaction times.
--
Hanno Böck
https://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
