Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 4 Apr 2011 14:07:16 +0200
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Subject: Re: Closed list

Hi,
* Marcus Meissner <meissner@...e.de> [2011-04-04 13:24]:
> On Mon, Apr 04, 2011 at 09:42:37AM +0100, Mark J Cox wrote:
> > >I've subscribed Mark.  So we have two representatives for Red Hat (Mark
> > >and Josh).
> > 
> > Limiting a distro to two or three representatives is going to make things 
> > tricky for Red Hat; we have a rather large dedicated security response 
> > team (as we publish over 300 advisories a year across 70 product/versions 
> > and have a number of folks dealing with 'incoming' issues spread, and my 
> > team is dispersed across 9 different countries).  If these representatives 
> > have been very active on v-s and oss-security is there a reason to limit?
> 
> Similar for SUSE. We currently have 3 engineers rotating through the incident
> manager role (and myself).

Same for Debian. We are currently cycling through a one week "front desk" 
period. Limiting that access to 2-3 people of the team would make that 
approach a bit unpractical for us in terms of handling undisclosed issues.
I also would welcome it if people who have been active on oss-sec and v-sec 
before should be allowed back to this list.

I can understand that you want to keep the list of subscribers low in order to 
prevent leaks. But from a practical point of view I see really no difference 
if a mail is passed to a team exploder of a distro by one of the allowed 
subscribers or directly sent to these members, at least in terms of attack 
surface/leaking risks. The only practical difference I see is who would be responsible
for such an incident. But if it's just about moving the responsibility out of
the list itself to the vendor while keeping the number of subscribers low you could as
well subscribe our team@ alias and encrypt mails with the team key.

That being said, my key data (I was added as part of Debian):
pub   1024D/73647CFF 2003-11-15
      Key fingerprint = FF46 E565 5CC1 E2E5 3F69  C739 1D87 E549 7364 7CFF
uid                  Nico Golde <nion@...ian.org>
uid                  Nico Golde <nico@...lde.de>
uid                  Nico Golde <nion@....net>
uid                  Nico Golde <nion@...tu-berlin.de>
sub   2048g/F774030E 2003-11-15

or alternatively a stronger key:
pub   4096R/A0A0AAAA 2009-06-01
      Key fingerprint = E1AB DE0E FFCA AEF3 9494  7592 CD4B 2AF3 A0A0 AAAA
uid                  Nico Golde <nion@...ian.org>
uid                  Nico Golde <nico@...lde.de>
uid                  Nico Golde <nion@...tu-berlin.de>
uid                  Nico Golde <nion@....net>
sub   4096R/E89CCA30 2009-06-02

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0xA0A0AAAA
For security reasons, all text in this mail is double-rot13 encrypted.

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.