Mention reporting security issues responsibly #9115
Conversation
|
Concept ACK, though, this reminds me, that we should offer a way how users can send encrypted mails to [email protected] |
|
Concept ACK.
This is a challenge in itself. I know of no way to do encrypted group addresses. Some security reporting addresses use a shared private GPG key specifically generated for that purpose, but after retiring the alert key we're probably not too happy to adapt private shared keys. Though this one would be used for reading mail only I guess... |
|
Yes. It's a challenge and involves writing to specific developers. |
|
Yes, this discussion belongs there. But... It would be nice to be able to encrypt such message inside the Bitcoin Core UI, using 1-of-n concept. |
.github/ISSUE_TEMPLATE.md
Outdated
There was a problem hiding this comment.
Indeed. The discussion belongs there, and so does the documentation. Maybe refer to the instructions for reporting security issues on the contact page: https://bitcoincore.org/en/contact/ instead of mentioning the address directly?
If we then happen to have GPG set up, it can be mentioned there without having to put everything into this template.
There was a problem hiding this comment.
I wanted to do so first, but the URLs are fragile and can change. And when the separate "Report security issues" page happens at bitcoincore.org, we will have to change URL here. Mail will probably be the same.
There was a problem hiding this comment.
I think https://bitcoincore.org/en/contact/ will always be the page for contact, even if there is a subsection with a list of gpg keys.
There was a problem hiding this comment.
How can you predict it will be a subsection? What if en-GB speakers will ask for en-GB and en-US page?
There was a problem hiding this comment.
"I wanted to do so first, but the URLs are fragile and can change" so are email addresses.
It's not impossible to update this again, it just should be rare.
paveljanik
force-pushed
the
20161109_secissues
branch
from
ac859f6 to
7d1de30
Compare
|
OK, OK ;-) |
|
ACK 7d1de30 |
7d1de30 Mention reporting security issues responsibly (Pavel Janík)
7d1de30 Mention reporting security issues responsibly (Pavel Janík)
7d1de30 Mention reporting security issues responsibly (Pavel Janík)
5 participants
Add a notice about reporting security issues responsibly to the GitHub issue template.