Date: Sun, 24 Apr 2011 16:44:29 -0400 From: Michael Gilbert <michael.s.gilbert@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Closed list Solar Designer wrote: > On Wed, Apr 20, 2011 at 10:19:01PM -0700, Drew Yao wrote: > > It seems that you're not opposed to Apple's inclusion on the list. Would you reconsider and allow us on the list? > > Personally, I'd be happy to invite Apple, *BSD's, and Google security > folks to have a sit at the table. Since Google doesn't release a Linux > distro for others to use, this precedent probably means subscribing > MontaVista and Wind River without any requirements on them making > advisories, updates, or whatever public. I know that there is increasing momentum for the new setup, but I think this solution is wrong. Its starting to look a lot like the old vendor-sec (too many participants), and drawing an appropriate line for participation is impossible and seems wrong. The ideal solution to the "too many eyes" problem would be to empower the researcher (issue submitter) to choose exactly which eyes they want involved. A way to achieve this would be a ml that accepts only encrypted messages for participants (participation would be unlimited) and an "archive participant". The list of participants is open to all (for the purpose of the researcher seeing which keys they want to encrypt for). When sending a message to the list, the researcher has to encrypt the message for archive key and at least one other valid participant (if not the message should be rejected, and instructions sent with a list of valid participant key fingerprints). In order to make sure the message was validly received, a checksum of the message should be published to an open list (probably oss-sec). The researcher can check this right away. Finally, the cleartext message should be posted to an open list after a period of time (probably two months max) so that the entire community can see and validate the closed discussion . This eliminates the possibility of a secret cabal forming or at least empowers the outside world to see the true reality (although with a delay). Best wishes, Mike
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.