[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 4 Apr 2011 04:25:52 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Closed list
On Sun, Apr 03, 2011 at 08:11:11PM -0400, Michael Gilbert wrote:
> Benji's trolling does raise a couple real issues. The private keys and
> passphrases of those responding here have now become highly lucrative
> targets for attackers. Hence, everyone on this new list needs to use
> good practices to keep their keys, hard drives, and computers safe.
> There should probably be some common guidelines for key safety for all
> participants.
Right. We're likely to specify some minimum requirements. For example,
Mike's 512-bit RSA key won't be allowed. (It is OK for testing, but not
when we use the list for real. Yet this is an improvement over the
plaintext vendor-sec and plaintext CC lists anyway.) Maybe storage of
private keys on a server won't be allowed (but we'd have to trust
members on that).
> Perhaps all discussions should be published in the open
> something like 2 months after the initial posting? That would be a
> kind of maximum private coordination period.
Yes, we may do this. Technically, an archive may be implemented as yet
another subscriber with its public key, where the private key
counterpart is not stored on any server and has a passphrase on it.
Thus, a possible compromise of the list server won't reveal past
messages (archived before the compromise, but not yet made public).
Pushing the archive public will then be a manual process, but that's OK
if it's only done once a month (omitting the last month's worth of
messages). In fact, a posting to oss-security will need to be made
whenever the public archive is updated.
Comments on this are welcome.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
