Re: Security related tooling project

2021-04-23 Thread Christopher Baines
Ludovic Courtès writes: > Hello Chris! > > Christopher Baines skribis: > >> In May last year (2020), I submitted an application to NLNet. The work I >> set out wasn't something I was doing at the time, but something I hadn't >> yet found time to work on, tooling specifically around security iss

Re: Security related tooling project

2021-04-23 Thread Christopher Baines
Bengt Richter writes: > Given that crims &co monitor developer discussions to discover > unfixed vulnerabilities and clues re exploiting them, > what are your ideas to avoid building a tool that can be abused? > > E.g., How will your tool avoid leaking info during an embargo window > while trust

Re: Security related tooling project

2021-04-17 Thread Bengt Richter
Hi, tl;dr: Given that crims &co monitor developer discussions to discover unfixed vulnerabilities and clues re exploiting them, what are your ideas to avoid building a tool that can be abused? E.g., How will your tool avoid leaking info during an embargo window while trusted developers are secre

Re: Security related tooling project

2021-04-17 Thread Ludovic Courtès
Hello Chris! Christopher Baines skribis: > In May last year (2020), I submitted an application to NLNet. The work I > set out wasn't something I was doing at the time, but something I hadn't > yet found time to work on, tooling specifically around security issues. > > The application got a bit l

Re: Security related tooling project

2021-04-04 Thread Chris Marusich
Christopher Baines writes: > Chris Marusich writes: > >> Christopher Baines writes: >> >>> In terms of looking at security from a project perspective, I'm thinking >>> about these kinds of needs/questions: >>> >>> - What security issues affect this revision of Guix? (latest or otherwise) >>> >

Re: Security related tooling project OFF TOPIC PRAISE

2021-04-04 Thread Joshua Branson
Christopher Baines writes: > Joshua Branson writes: > >> Christopher Baines writes: >> >>> 1: https://git.cbaines.net/guix/tooling-to-improve-security-and-trust/about/ >> >> Are you using guix system to serve the above link? I didn't realize >> that gitolite could render a README document so w

Re: Security related tooling project

2021-04-04 Thread Xinglu Chen
On Sun, Apr 04 2021, Christopher Baines wrote: > Cool :) While it's not directly security related, I really want the > subscriptions functionality I'm planning to work on to be done so that > people can subscribe to things related to the packages they use, like > new versions becoming available, o

Re: Security related tooling project

2021-04-04 Thread Christopher Baines
Chris Marusich writes: > Christopher Baines writes: > >> In terms of looking at security from a project perspective, I'm thinking >> about these kinds of needs/questions: >> >> - What security issues affect this revision of Guix? (latest or otherwise) >> >> - How do Guix contributors find out

Re: Security related tooling project

2021-04-04 Thread Christopher Baines
Léo Le Bouter writes: > On Sat, 2021-04-03 at 11:41 +0100, Christopher Baines wrote: >> Please let me know if you have any comments or questions! > > That's really really awesome Chris! I especially like that also users > are invited to particpate in the process and the information is shared > t

Re: Security related tooling project OFF TOPIC PRAISE

2021-04-04 Thread Christopher Baines
Joshua Branson writes: > Christopher Baines writes: > >> Hey, >> >> In May last year (2020), I submitted an application to NLNet. The work I >> set out wasn't something I was doing at the time, but something I hadn't >> yet found time to work on, tooling specifically around security issues. >>

Re: Security related tooling project

2021-04-03 Thread Chris Marusich
Christopher Baines writes: > In terms of looking at security from a project perspective, I'm thinking > about these kinds of needs/questions: > > - What security issues affect this revision of Guix? (latest or otherwise) > > - How do Guix contributors find out about new security issues that >

Re: Security related tooling project

2021-04-03 Thread Léo Le Bouter
On Sat, 2021-04-03 at 11:41 +0100, Christopher Baines wrote: > Hey, > > In May last year (2020), I submitted an application to NLNet. The > work I > set out wasn't something I was doing at the time, but something I > hadn't > yet found time to work on, tooling specifically around security > issues

Re: Security related tooling project OFF TOPIC PRAISE

2021-04-03 Thread Joshua Branson
Christopher Baines writes: > Hey, > > In May last year (2020), I submitted an application to NLNet. The work I > set out wasn't something I was doing at the time, but something I hadn't > yet found time to work on, tooling specifically around security issues. > > The application got a bit lost, p

Security related tooling project

2021-04-03 Thread Christopher Baines
Hey, In May last year (2020), I submitted an application to NLNet. The work I set out wasn't something I was doing at the time, but something I hadn't yet found time to work on, tooling specifically around security issues. The application got a bit lost, probably somewhat down to email issues on