[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20110424164429.c07d917f.michael.s.gilbert@gmail.com>
Date: Sun, 24 Apr 2011 16:44:29 -0400
From: Michael Gilbert <michael.s.gilbert@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Closed list
Solar Designer wrote:
> On Wed, Apr 20, 2011 at 10:19:01PM -0700, Drew Yao wrote:
> > It seems that you're not opposed to Apple's inclusion on the list. Would you reconsider and allow us on the list?
>
> Personally, I'd be happy to invite Apple, *BSD's, and Google security
> folks to have a sit at the table. Since Google doesn't release a Linux
> distro for others to use, this precedent probably means subscribing
> MontaVista and Wind River without any requirements on them making
> advisories, updates, or whatever public.
I know that there is increasing momentum for the new setup, but I
think this solution is wrong. Its starting to look a lot like the old
vendor-sec (too many participants), and drawing an appropriate line for
participation is impossible and seems wrong.
The ideal solution to the "too many eyes" problem would be to empower
the researcher (issue submitter) to choose exactly which eyes they want
involved. A way to achieve this would be a ml that accepts only
encrypted messages for participants (participation would be unlimited)
and an "archive participant". The list of participants is open to all
(for the purpose of the researcher seeing which keys they want to
encrypt for).
When sending a message to the list, the researcher has to encrypt the
message for archive key and at least one other valid participant (if
not the message should be rejected, and instructions sent with a list of
valid participant key fingerprints). In order to make sure the message
was validly received, a checksum of the message should be published to
an open list (probably oss-sec). The researcher can check this right
away.
Finally, the cleartext message should be posted to an open list after a
period of time (probably two months max) so that the entire community
can see and validate the closed discussion . This eliminates the
possibility of a secret cabal forming or at least empowers the outside
world to see the true reality (although with a delay).
Best wishes,
Mike
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
