On Mon, Jan 16, 2006 at 01:43:30AM +0100, Max Vozeler wrote:
> On Sun, Jan 15, 2006 at 10:48:23PM +0000, Steve Kemp wrote:
> > In the past I've used livejournal for that
> > purpose, limiting access to a defined group of people and hoping
> > they won't leak. (To date nobody has, but also to date nothing
> > has been terribly severe or serious either.)
>
> Yes, it would be illusionary to assume that messages will not
> leak from such a list in some way. While there has been an ITP for
> a mailing list manager that transparently handles encrypting to
> gpg pubkeys of subscribers (#316128) which could be used, there has
> been little progress since, and even with such a solution a
> compromised host system could leak the mails.
Doesn't mailman already do that? I'm a subscribe to a list that uses mailman
and transparently handles GPG encryption (you encrypt messages to the mailman
address and it re-encrypts them to all subscribers). I could ask for details
on how it's setup if anybody is interested.
> I suppose we could archive the list in an mbox local to the
> server and bounce (as in mutt <b>) messages to debian-audit or a
> dedicated list when they should be disclosed. Or just publish
> one mbox per bug with the complete discussions.
That, or have some kind of pseudo header that would track a database (i.e. a
plain text file) where headers are associated with status (i.e. disclosed /
non-public) and have it publish headers of mails that have been already
disclosed. The 'database' could be something like
[ programX-bufov-3 ] : PRIVATE
[ programX-tempfile-10 ] : PUBLIC
Subscribes could then use that tag (programX-whatever) in their mail's
subject line and an automatic robot could publish the mails associated with a
tag whenever the status of the bug changed from PRIVATE to PUBLIC or
something like that. Even if the file was leaked, since it contains no
details of the vulnerabilities itself it wouldn't be much of an issue (and
the tags could be made meaningless to prevent them from giving away info,
they could be generate automatically, even)
Translators already use robots to track mails based on subject tags so maybe
that code could be adapted to do something like that [1]. Sounds like
something doable, given enough time.
Regards
Javier
[1] It's called the l10n-bot and there are several variants, some "listen" to
the mailing list and others review web archives to extract information from
there.