Re: Announcing https://github.com/RedHatProductSecurity/Certificates-Shipped/

[Gsunde Orangen <gsunde.orangen () gmail com>]

Totally reasonable, Kurt.
Where would you actually see the border between what's in and what's
out? Actually there are lots of (proprietary source) vendor products out
there that are heavily built on open source (e.g. virtually all linux
kernel based embedded devices)
Not saying someone should go through the hassles to chase for it - but
if the info is brought to you/to the repository...

Gsunde


On 2015-11-2, 18:37 Kurt Seifried wrote:> On Wed, Nov 25, 2015 at 10:07
AM, Hanno Böck <hanno () hboeck de> wrote:
> > On Tue, 24 Nov 2015 21:38:35 -0700
> > Kurt Seifried <kseifried () redhat com> wrote:
> >
> > > https://github.com/RedHatProductSecurity/Certificates-Shipped/
> > >
> > > The idea is to create a comprehensive list of shipped certs/keys/etc
> > > by open source vendors/distributions/projects so that:
> >
> > That's good, but in this case why limit to open source vendors?
>
> Because this is the Open Source Security mailing list, and I work for a
> company (Red Hat) that does Open Source and because I have no interest in
> the hassles of dealing with proprietary software (legal
> threats/licensing/DMCA/etc.).
>
> If you would like to work with proprietary vendors on such an effort I
> welcome you to try, you can easily setup a project on GitHUB and move ahead
> without any need to coordinate with the Open Source effort.
>
>
> > Actually the MS certs are probably the most interesting for
> > superfish/edell-like scenarios. And I see no reason why they shouldn't
> > be transparent.
>
> Talk to Microsoft then, OSS-Security is not the forum for dealing with this
> Microsoft related issue.
>
>
> > --
> > Hanno Böck
> > http://hboeck.de/
> >
> > mail/jabber: hanno () hboeck de
> > GPG: BBB51E42