Re: Closed list

[Michael Gilbert <michael.s.gilbert () gmail com>]

Solar Designer wrote:

> On Sun, Apr 03, 2011 at 08:11:11PM -0400, Michael Gilbert wrote:
> > Benji's trolling does raise a couple real issues.  The private keys and
> > passphrases of those responding here have now become highly lucrative
> > targets for attackers.  Hence, everyone on this new list needs to use
> > good practices to keep their keys, hard drives, and computers safe.
> > There should probably be some common guidelines for key safety for all
> > participants.
>
> Right.  We're likely to specify some minimum requirements.  For example,
> Mike's 512-bit RSA key won't be allowed.  (It is OK for testing, but not
> when we use the list for real.  Yet this is an improvement over the
> plaintext vendor-sec and plaintext CC lists anyway.)  Maybe storage of
> private keys on a server won't be allowed (but we'd have to trust
> members on that).
>
> > Perhaps all discussions should be published in the open
> > something like 2 months after the initial posting?  That would be a
> > kind of maximum private coordination period.
>
> Yes, we may do this.  Technically, an archive may be implemented as yet
> another subscriber with its public key, where the private key
> counterpart is not stored on any server and has a passphrase on it.
> Thus, a possible compromise of the list server won't reveal past
> messages (archived before the compromise, but not yet made public).
>
> Pushing the archive public will then be a manual process, but that's OK
> if it's only done once a month (omitting the last month's worth of
> messages).  In fact, a posting to oss-security will need to be made
> whenever the public archive is updated.

Wouldn't the easiest solution be to have a cron job check that the age
of the message is greater than X days, decrypt it, and mail it to a
different archive/public list?

I think automatic publishing is the only way this is going to work.
No one is going to want to manually do the work.  Plus an automatically
enforced maximum time frame will force issues to get fixed.  Automation
also means that nothing is being veiled.  Computers don't discriminate,
humans do.

Best wishes,
Mike