Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 13 Feb 2016 05:52:44 +0000
From: halfdog <me@...fdog.net>
To: oss-security@...ts.openwall.com
Subject: Thoughts about security of Linux distributor collaboration platforms,
 bugtrackers for opensource software

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello List,

As just written in a mail to another list, this might also be
interesting for discussion here.:

As it would be the most natural thing for e.g. NSA, China, ... (those
with capabilities to monitor large amount of network traffic) to just
record all mails from large-scale Linux distribution collaboration and
issue tracking systems containing the keyword "security", and as this is
very cheap way to get to near-zero day material, I would assume, that
this is already done. This is like serving them zero days on a golden
plate.

Hence really critical security material perhaps should not go to such
platforms, e.g. Ubuntu Launchpad, or the platform should be modified to
send security issues only in encrypted mails without talkative title,
members without mail public key registered should get only message "Bug
[Number]: Info changed" including the HTTPS link to the issue in the
platform.

What do you think?

Does someone have a link to anyone having access to the selector lists
leaked by Snowden to ask them, which of the distros are already in scope
or otherwise to discard this e-mail as pure paranoia?

Kind regards,
hd

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAla+xKUACgkQxFmThv7tq+7nNACeMwrk+Sej12e02R0r8hETDC06
xzMAn00wxLheHNo6rgI9eEwI+jS2bygl
=9VEH
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ