oss-security - Re: [oCERT-2011-003] multiple implementations denial-of-service via hash algorithm collision

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111229225821.GS27039@core.inversepath.com>
Date: Thu, 29 Dec 2011 23:58:21 +0100
From: Andrea Barisani <lcars@...rt.org>
To: Solar Designer <solar@...nwall.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: [oCERT-2011-003] multiple implementations denial-of-service
 via hash algorithm collision


Hi Solar,

> I think this is a rare exception to oCERT's policy, too.  It says:
>
> "- under extremely exceptional circumstances, if the oCERT Team and all
> the parties involved feel the need for longer time, a 2 months embargo
> can be applied, in this case we would clearly document the decision for
> public review"

> Andrea - you could want to "clearly document the decision for public
> review" now, although I guess your rationale was similar to mine (when I
> decided not to object to the unusually long embargo period this time).

As stated in our timeline the embargo date was requested by reporters:
"2011-09-25: vulnerability report received, reporters set embargo date to December 27th"

Our disclosure policy also says:
"- in any circumstance reporter preference will always be honoured in case a
joint agreement is not reached, as oCERT would be anyway unable to force its
embargo"

We tried to negotiate an earlier embargo time as, obviously, many complained
about the unfortunate timing considering xmas holidays but the reporters really
wanted to release this after the CCC talk.

It is oCERT policy to not leak reports before the desired date set by the
reporters if a more favourable one is not agreed upon.

Hope this clarifies the exception.

Cheers

-- 
Andrea Barisani |                Founder & Project Coordinator
          oCERT | OSS Computer Security Incident Response Team

<lcars@...rt.org>                         http://www.ocert.org
 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
        "Pluralitas non est ponenda sine necessitate"

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.