[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-bugs] #9186 [Website]: Document how to report security vulnerabilities

#9186: Document how to report security vulnerabilities
-------------------------+-----------------
     Reporter:  lunar    |      Owner:
         Type:  defect   |     Status:  new
     Priority:  normal   |  Milestone:
    Component:  Website  |    Version:
   Resolution:           |   Keywords:
Actual Points:           |  Parent ID:
       Points:           |
-------------------------+-----------------
Changes (by mcs):

 * cc: mcs (added)


Comment:

 Regarding what email address to use, the following is summarized from a
 tor-project IRC conversation:
 - Section 4 of RFC 2142 says we should reserve security@... for people to
 report network / infrastructure security issues.
 - On the other hand, Google advertises security@xxxxxxxxxx as the method
 to report software vulnerabilities as well as security incidents.  See
 http://www.google.com/about/appsecurity/

 So maybe the right thing to do is to combine both roles behind one email
 address (which will probably lead to more work / more hassle for us
 internally, but it would make things easier for outsiders).

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/9186#comment:4>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs