[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20160212020526.GE25680@hunt>
Date: Thu, 11 Feb 2016 18:05:26 -0800
From: Seth Arnold <seth.arnold@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: STARTTLS for this list?
On Thu, Feb 11, 2016 at 04:05:53PM -0500, Alex Gaynor wrote:
> Not sure if anyone saw, but gmail has been rolling out UI indicators for
> MTAs which don't use TLS:
> https://gmailblog.blogspot.com/2016/02/making-email-safer-for-you-posted-by.html
This seems like shouting at the wrong person about a problem they can't
address. What is the average gmail user supposed to do with this
information? While it draws a parallel to the lock icon in browsers to
indicate HTTPS is used I think this overstates how "secure" an email is
just because it was sent over one hop using STARTTLS.
If Google actually feels STARTTLS is important enough to users to show
them an icon then they should use this as step one and announce step two
is requiring STARTTLS on a specific date. That only works, of course,
if they announce their intention _and_ a date.
> I was surprised to see this indicator on mail from oss-security. Does
> anyone know who has the keys to `list.openwall.com` so they can turn on
> STARTTLS for outbound email?
That'd be "listadmin [at] oss [dash] security [dot] openwall [dot] org"
http://oss-security.openwall.org/wiki/mailing-lists/oss-security
Probably Alexander. :)
It doesn't seem like a top priority to me: STARTTLS solves one set of
problems and introduces a much larger set of problems. I'm not sure any of
the solved problems are actually pressing problems to a public mail list.
Hosting a mail list is already miserable enough (for example, I don't
think mail From: google addresses actually makes to Google users; also, I
don't know how the moderators manage to keep this list spam-free with zero
mistakes, either false positives or false negatives.) -- adding a half-dozen
more reasons why mail delivery can fail is surely not fun.
Thanks
Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
