Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 24 Sep 2012 20:32:38 -0400
From: Michael Gilbert <>
Subject: Re: Re: Re: Re: Re: CVE request(?): gpg: improper file
 permssions set when en/de-crypting files

On Mon, Sep 24, 2012 at 8:24 PM, Michael Gilbert
<> wrote:
> On Mon, Sep 24, 2012 at 5:46 PM, Tavis Ormandy wrote:
>>> > I think you've misunderstood the problem, and it's trivial to solve.
>>> No, I'm thinking about the broader implication.  If you're arguing that
>>> gpg should be modified to better handle permissions, then all applications
>>> potentially handling sensitive information should as well: file editors,
>>> and what not.  Otherwise, what makes gpg such a special case?
>> I think you've confused my post with someone elses.
> See Steve Christy's snowball post.  Again, I'm considering the
> totality of the system.  Setting 644 as a default for gpg is I suppose

Correction, not 644, but using the input file's permissions as the
basis for the output file's permissions (obviously before applying

Best wishes,

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.