[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 3 Feb 2012 22:00:24 -0500
From: Michael Gilbert <michael.s.gilbert@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: distros & linux-distros embargo period and message format
On Fri, Feb 3, 2012 at 8:45 PM, Solar Designer wrote:
> On Fri, Feb 03, 2012 at 08:26:26PM -0500, Michael Gilbert wrote:
>> I think the important aspect here is the transparency of the private
>> discussion (after an appropriate delay), rather than the length of the
>> delay itself.
>
> Thank you for sharing your opinion.
>
> Yet the delay itself matters too. There are different opinions as to
> whether it is "the important aspect" or not.
That's why I think its more appropriate to defer such decisions to the
researcher who understands the complexity of the problem at hand (of
course hopefully allowing negotiation with those affected to choose a
disclosure date that can be met).
>> That can be set by the researcher (with some reasonable
>> maximum, like a month).
>>
>> We all should be able to see what is going on over in the closed list.
>> Although it is unlikely being used for nefarious purposes (hiding
>> issues permanently, etc.), transparency (after a delay) is the only
>> way to show that it is not. Anyway, 30 days seems appropriate.
>
> I don't mind. Like I said, I need a tool - a program to mass-decrypt a
> PGP/MIME mbox, producing another mbox. I think such a program might be
> generally useful. Well, or alternatively I need to introduce a
> different mechanism for the archive - not treat it as a regular
> subscriber like I intended to.
Completely unfleshed out, but a pseudo-bash script along the lines of
the following should do it:
echo "" > newmbox
gpg-agent --allow-preset-passphrase
/usr/lib/gnupg2/gpg-preset-passphrase --preset <cache id>
cat mbox | while read line; do
test <header> && echo $line >> /tmp/header
test <body> && echo $line >> /tmp/body
if [ <end off body> ]; then
cat /tmp/header >> newmbox
cat /tmp/body | gpg --decrypt >> newmbox
fi
done
/usr/lib/gnupg2/gpg-preset-passphrase --forget
Obviously a bit more work there to figure out appropriate conditionals
to put in the angle brackets.
Best wishes,
Mike
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
