From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com From: Anthony Liguori In-Reply-To: References: <510A8F11.6050908@linux.vnet.ibm.com> Date: Thu, 31 Jan 2013 13:30:04 -0600 Message-ID: <874nhxb16r.fsf@codemonkey.ws> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Subject: Re: [kernel-hardening] Secure Open Source Project Guide To: Kees Cook , "kernel-hardening@lists.openwall.com" Cc: Frank Novak , George Wilson , Joel Schopp , Kevin Wolf , Warren Grunbok II List-ID: Kees Cook writes: > On Thu, Jan 31, 2013 at 7:34 AM, Corey Bryant wrote: >> In light of events like this http://lwn.net/Articles/535149/ "China, GitHub >> and the man-in-the-middle (Greatfire)", we are thinking that a guide for >> securing open source projects is needed. For example, recommending pull >> requests or commits be PGP signed are a few things we've discussed that >> could defend against a MITM attack inserting malicious code. >> >> Does anyone have any thoughts as to where we could publish such a guide? >> Perhaps the Linux Foundation? >> >> I believe we have the resources on this mailing list to work through the >> details and put together a succinct guide that we could take to a wider >> audience. > > Yeah, sounds good. I think we could easily use the kernel-security > wiki to work on it initially, and if it needs a different home in the > end, we can move it then. If someone picks a home, I'll do a brain dump of some of my concerns and what I think can be done about it. Regards, Anthony Liguori > > -Kees > > -- > Kees Cook > Chrome OS Security