Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 13 Feb 2016 14:15:13 +0100
From: Hanno Böck <>
Subject: Re: Thoughts about security of Linux distributor
 collaboration platforms, bugtrackers for opensource software

On Sat, 13 Feb 2016 05:52:44 +0000
halfdog <> wrote:

> Hence really critical security material perhaps should not go to such
> platforms, e.g. Ubuntu Launchpad, or the platform should be modified
> to send security issues only in encrypted mails without talkative
> title, members without mail public key registered should get only
> message "Bug [Number]: Info changed" including the HTTPS link to the
> issue in the platform.

This is roughly what mozilla does and I like it a lot. They have a bug
tracker over https and you can add a PGP key. If you don't add a PGP
key and report a security bug you won't get updates via mail

I think this is definitely an area that could need improvement. A lot
of projects don't have any reasonable way to securely report bugs. And
some actively discourage reporting bgus in a secure way (apache has
some note on their webpage that you may send your reports encrypted to
some people, but have to expect longer delays if you do so instead of
using the "normal" unencrypted way).
One problem is also that e.g. the github bugtracker (and I think many
other bugtrackers as well) doesn't consider sensitive bug reports.

But I also agree with Florian: Part of the problem can be mitigated by
not keeping things under the hood for too long. I'm often disappointed
with slow reaction times.

Hanno Böck


Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.