[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5656263F.80101@gmail.com>
Date: Wed, 25 Nov 2015 22:21:03 +0100
From: Gsunde Orangen <gsunde.orangen@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Announcing
https://github.com/RedHatProductSecurity/Certificates-Shipped/
Totally reasonable, Kurt.
Where would you actually see the border between what's in and what's
out? Actually there are lots of (proprietary source) vendor products out
there that are heavily built on open source (e.g. virtually all linux
kernel based embedded devices)
Not saying someone should go through the hassles to chase for it - but
if the info is brought to you/to the repository...
Gsunde
On 2015-11-2, 18:37 Kurt Seifried wrote:> On Wed, Nov 25, 2015 at 10:07
AM, Hanno Böck <hanno@...eck.de> wrote:
>
>> On Tue, 24 Nov 2015 21:38:35 -0700
>> Kurt Seifried <kseifried@...hat.com> wrote:
>>
>>> https://github.com/RedHatProductSecurity/Certificates-Shipped/
>>>
>>> The idea is to create a comprehensive list of shipped certs/keys/etc
>>> by open source vendors/distributions/projects so that:
>>
>> That's good, but in this case why limit to open source vendors?
>>
>
> Because this is the Open Source Security mailing list, and I work for a
> company (Red Hat) that does Open Source and because I have no interest in
> the hassles of dealing with proprietary software (legal
> threats/licensing/DMCA/etc.).
>
> If you would like to work with proprietary vendors on such an effort I
> welcome you to try, you can easily setup a project on GitHUB and move ahead
> without any need to coordinate with the Open Source effort.
>
>
>>
>> Actually the MS certs are probably the most interesting for
>> superfish/edell-like scenarios. And I see no reason why they shouldn't
>> be transparent.
>>
>
> Talk to Microsoft then, OSS-Security is not the forum for dealing with this
> Microsoft related issue.
>
>
>>
>> --
>> Hanno Böck
>> http://hboeck.de/
>>
>> mail/jabber: hanno@...eck.de
>> GPG: BBB51E42
>>
>
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
