Sponsored link
Vyatta –
Linux & Open Source
Alternative to Cisco –
Advanced Routing,
Firewall, VPN, QoS..
Free Download ->
| |||||||||||
TWiki holeTWiki holePosted Nov 18, 2004 12:59 UTC (Thu) by colas (guest, #26092)In reply to: TWiki hole by daniels Parent article: freedesktop.org site compromised
Well, what should be done is have all TWiki admins apply the patch, and I do not think they go to TWiki front page very often, so we must rely on other mecanism. So, let's take a small survey, in what way would you (and others reading this thread) have preferred to be warned of security problems?
(Log in to post comments)
TWiki hole Posted Nov 18, 2004 14:11 UTC (Thu) by hmh (subscriber, #3838) [Link] [1] You do not have it yet? An announcement mailing list (moderated), where you send at most 1-2 emails/month and all security notices is really a must for any serious project.
[2] You should at the very least notify people through BugTrack, or a bunch of vendor security teams (make sure some Linux distributions are among them, please) which will get word to everyone else.
[3] This would be nice, but you better use proper cryptography to authenticate the updates...
So my reply is all of the above, and that there is no excuse for [1] not being deployed yet.
TWiki hole Posted Nov 24, 2004 21:58 UTC (Wed) by maphew (guest, #1147) [Link] >[2] You should at the very least notify people through BugTrack,
A notice was sent through BugTraq on Nov 12th. http://seclists.org/lists/bugtraq/2004/Nov/0187.html
TWiki hole Posted Nov 24, 2004 22:42 UTC (Wed) by hmh (subscriber, #3838) [Link] Then the TWiki users can't really complain that there was no notification of the issue, or that it was hidden away inside a Wiki. Maybe it could have been done better, but that's something else.
TWiki hole Posted Nov 18, 2004 17:27 UTC (Thu) by bronson (subscriber, #4806) [Link] Um, it is YOUR obligation to notify your users of security holes using any reasonable means possible, especially if the hole is already in the wild! This includes Bugtraq, your front page, your news section, your mailing lists, notifying all distributions that include your package, etc. Projects that do this well are PHP, Apache, Gallery, ISC software, etc.
At this point, it seems like the TWiki project has some serious damage control to perform. How are you going to assure your users that something like this will not happen again?
TWiki hole Posted Nov 25, 2004 17:22 UTC (Thu) by Cato (subscriber, #7643) [Link] Try searching for CAN-2004-1037 - this will find all the various reports of this vulnerability to a wide range of security email lists, including Bugtraq (most sent on Nov 12th).
TWiki hole Posted Nov 18, 2004 18:07 UTC (Thu) by JoeBuck (subscriber, #2330) [Link] Forget about any mechanism where you tell only registered TWiki users about bugs. The Twiki attempts to pressure people to register are wrong-headed, and there's nothing to stop black hats from subscribing to any mailing list you set up.Don't hide bugs. Certainly it can be wise to let the good guys have a head start, for example by alerting any distros that package TWiki in advance. But once you know that people are actively exploiting a security hole, it's your obligation to alert the general public.
TWiki hole Posted Nov 24, 2004 9:47 UTC (Wed) by Cato (subscriber, #7643) [Link] I agree about the low-volume security alert list - not yet in place, but as one of the developers I will help to make sure this happens. Separately, we removed the requirement to register for <a href="http://twiki.org/download.html">TWiki downloads</a> a while back - in retrospect we should have created the announcement list then.<p> There is some discussion of the proposed TWiki <a href="http://twiki.org/cgi-bin/view/Codev/TWikiSecurityAlertPro...">security alert process</a> at TWiki.org, please feel free to join in there.
|
|||||||||||