Re: About 'qemu-security' mailing list

[Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>]

. monster snip..
> > Maybe we could start with a moderated list and improvise as we go forward?
> 
> I really think that encryption of the details of a vulnerability is
> important, if somehow it gets intercepted - which is not that difficult
> with e-mail - then there is the potential for a malicious party to
> exploit it before a fix is available to distros, and deployed.

.. I found out yesterday that most of the emails around the world are
using TLS which does remove the interception part. The attack is then
to get on say Prasad's box .. and if you do that it really does not
matter if you use encryption or not.

> 
> Something that has happened since the Intel Spectre/Meltdown
> vulnerabilities were initially brought to light is more communication
> between security teams in various orgs. To do this those discussions
> have started being done on Keybase, which provides secure chats as well
> as secured Git repos.
> 
> Has anything like that being considered as the point for subsequent
> discussions on issues post the initial disclosure?

The problem with Keybase was how to review patches. Now if they had a
encrypted mailing list as part of their Git repos that would be awesome.
(Trying to find a "Feature request" but not having much luck :-()