[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANO=Ty2KagFAAbV02zSEgm_TrXg5b2ckHqLXbz2BG_dWZoH8ww@mail.gmail.com>
Date: Wed, 25 Nov 2015 14:49:16 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: Announcing https://github.com/RedHatProductSecurity/Certificates-Shipped/
On Wed, Nov 25, 2015 at 2:21 PM, Gsunde Orangen <gsunde.orangen@...il.com>
wrote:
> Totally reasonable, Kurt.
> Where would you actually see the border between what's in and what's
> out? Actually there are lots of (proprietary source) vendor products out
> there that are heavily built on open source (e.g. virtually all linux
> kernel based embedded devices)
> Not saying someone should go through the hassles to chase for it - but
> if the info is brought to you/to the repository...
>
>
So in short: only stuff that is Open Source licensed. Definitely things
that are fully Open Sourced (e.g. upstream project, or distributions like
Red Hat or Debian). If a proprietary vendor uses some OpenSource bits then
I'd be interested if the upstream project also ships it, so it would go
under that upstream listing. If it's stuff the proprietary vendors are
adding I'm not really interested, for two reasons:
1) proprietary/closed source vendors have a long history of doing silly
things, so it's a given they'll have problems here
2) the chances of getting them to fix it are low, so I'm simply not
interested in spending any time/resources on it.
If you want to create a project in GitHub that covers OpenSource bits used
in mostly proprietary vendors (e.g. Mac OS X) then feel free to, but again
for a multitude of reasons I'm not interested in that side of the problem.
> Gsunde
>
Also as an example of what I am looking for I did an initial dump of Fedora
23 (all of it) we end up with about 83 packages containing certs/keys/etc.
Some are obvious (archlinux-keyring, debian-keyring, ca-certificates,
bind), some are embedded (mostly copies of the Mozilla CA cert stuff) and
some need more research. If anyone wants to add notes/data to them please
feel free.
https://github.com/RedHatProductSecurity/Certificates-Shipped/tree/master/distributions/Fedora/23
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
