Preventing supply chain attacks via rekor

/rekor -- Regards, Huzaifa Sidhpurwala / Red Hat Product Security ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US

Re: F35 Change: Use yescrypt as default hashing method for shadow passwords (System-Wide Change proposal)

I can do it, once its gets approved/included On Thu, Jun 10, 2021 at 6:21 PM Neal Gompa wrote: > On Mon, Jun 7, 2021 at 3:00 PM Ben Cotton wrote: > > > > > https://fedoraproject.org/wiki/Changes/yescrypt_as_default_hashing_method_for_shadow > > > > == Summary == > > Make the yescrypt hashing

Re: Fedora Security Team

I dont think creating 5 bugs per CVE is a correct statement here. We create one bug per product per CVE. So if fedora is affected with a node.js, we create one fedora tracker per CVE. The tracker should block the CVE bug, so it should be easy to find. Also you can search for bugs with

Re: RFC: Security policy adjustments to make it easier to implement and more friendly to maintainers

https://docs.fedoraproject.org/en-US/project/code-of-conduct/ >> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines >> List Archives: >> https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org > ___________ &g

Re: RFC: Security policy adjustments to make it easier to implement and more friendly to maintainers

ems downtime. Not all of them may be applicable for fedora users. The above being said, i am ok with deferring lows, but please lets fix or close others? > > Rich. > -- Huzaifa Sidhpurwala / Red Hat Product Security ___ devel mailing list

Re: RFC: Security policy adjustments to make it easier to implement and more friendly to maintainers

.@lists.fedoraproject.org > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/devel@list

Re: F31 System-Wide Change proposal: Enable Compiler Security hardening flags by default in G

ub's suggestion i am also planning to remove to fortify_source flag and keep others. The plan is to start some where and each release work with glibc and other teams so that we make more such security flags as default and also work with packages which break due to inclusion of such flags. -- H

Re: F31 System-Wide Change proposal: Enable Compiler Security hardening flags by default in G

To unsubscribe send an email to devel-le...@lists.fedoraproject.org > Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedoraproject.org/archives/list/

Re: F31 System-Wide Change proposal: Enable Compiler Security hardening flags by default in G

>> >> == Owner == >> * Name: [[User:huzaifas|Huzaifa Sidhpurwala]] >> * Email: huzai...@redhat.com >> * Release notes owner: huzai...@redhat.com >> >> >> == Detailed Description == >> Currently GCC does not enable any security hardening flags by defau

Re: F31 System-Wide Change proposal: Enable Compiler Security hardening flags by default in G

; >> Actually the default optflags already has -Wall (which includes >> -Wformat) and -Werror=format-security which enables that warning >> and turns on -Werror for it. > > I wonder why this change is suggesting to add the flags if they > are already present in our cu

Re: F31 System-Wide Change proposal: Enable Compiler Security hardening flags by default in G

https://fedoraproject.org/wiki/Changes/HardenedCompiler >> >> == Summary == >> By Default enable a few security hardening flags which are used with GCC. >> >> == Owner == >> * Name: [[User:huzaifas|Huzaifa Sidhpurwala]] >> * Email: huzai...@redhat.com >> * Re

Re: F31 System-Wide Change proposal: Enable Compiler Security hardening flags by default in G

re defaults to GCC for each release. I am open to add PIE by default though, if you feel its not going to break large number of packages. > PIE-by-default compilers are very common already, although there are > many StackOverflow questions from peopel who use the

Re: Expect nag email if you are maintaining a package in fedora with important/critical flaw open against it

s this security related or can i nag about  the  FE-NEEDSPONSOR flag in > wdune ? > This is related to https://pagure.io/fesco/issue/2090#comment-554987 -- Huzaifa Sidhpurwala / Red Hat Product Security Team ___ devel mailing list -- devel@lists.fedo

Expect nag email if you are maintaining a package in fedora with important/critical flaw open against it

Hello, Really nothing else to say here, apart from $SUBJECT. Thanks! -- Huzaifa Sidhpurwala / Red Hat Product Security Team ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org

Re: responding to CVEs

; untrusted input, especially here where we are talking about importing > external files! So those security issues absolutely MUST be fixed! > Heap-based buffer overflows are indeed serious and if there is a patch, please apply it! Also no serious upstream will ignore these flaws, if they do

Re: Reminder: Package Maintainers please fix your security bugs!

On 09/05/2018 12:24 PM, Alexander Bokovoy wrote: > On Wed, 05 Sep 2018, Huzaifa Sidhpurwala wrote: >> Hi All, >> >> This is a gentle reminder for package maintainers to fix security bugs >> in the packages they maintain. A complete list of open security flaws

Reminder: Package Maintainers please fix your security bugs!

! -- Huzaifa Sidhpurwala / Red Hat Product Security Team ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://getfedora.org/code-of-conduct.html List

Re: New policy for orphaning/retiring packages with open security bugs

tes/classification contains the necessary details. Please let me know if you need more information! -- Huzaifa Sidhpurwala / Red Hat Product Security Team ___ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fe

Re: Making Fedora secure - Package exit policy for security

On 08/01/2018 02:16 PM, Daniel P. Berrangé wrote: > On Wed, Aug 01, 2018 at 10:40:20AM +0530, Huzaifa Sidhpurwala wrote: >> On 07/31/2018 08:51 PM, Daniel P. Berrangé wrote: >> >>> >>> Do we have any analysis showing what would be the fallout if we applied >

Re: Making Fedora secure - Package exit policy for security

On 08/01/2018 01:19 PM, Nikos Mavrogiannopoulos wrote: > On Tue, 2018-07-31 at 09:09 +0530, Huzaifa Sidhpurwala wrote: >> Hi All, >> >> I was asked to bring this issue[1] to the developer community before >> FESCO makes a decision. >> >> In several insta

Re: Making Fedora secure - Package exit policy for security

On 08/01/2018 01:41 PM, Daniel P. Berrangé wrote: > On Wed, Aug 01, 2018 at 10:33:11AM +0530, Huzaifa Sidhpurwala wrote: >> On 07/31/2018 08:33 PM, Rex Dieter wrote: >> >>>> 1. If a CRITICAL or IMPORTANT security issue is open against a package >>>&g

Re: Making Fedora secure - Package exit policy for security

> https://bugzilla.redhat.com/buglist.cgi?bug_status=NEW_status=ASSIGNED=Fedora=SecurityTracking%2C%20_type=allwords_id=9076731=changeddate%2Cpriority%2Cbug_id=Fedora_based_on=_format=advanced -- Huzaifa Sidhpurwala / Red Hat Product Security Team ___

Re: Making Fedora secure - Package exit policy for security

On 07/31/2018 05:05 PM, Ondřej Lysoněk wrote: > On 31.7.2018 05:39, Huzaifa Sidhpurwala wrote: >> I would like to propose the following: >> >> >> 1. If a CRITICAL or IMPORTANT security issue is open against a package >> in Fedora-X and by the time X is E

Re: Making Fedora secure - Package exit policy for security

he package maintainer be doing it in the first place? > > Regards, > Daniel > -- Huzaifa Sidhpurwala / Red Hat Product Security Team apt-cacher-ng asterisk async-http-client binutils bzr chromium connman docker-distri

Re: Making Fedora secure - Package exit policy for security

its a big problem imo. Theoretically if there is an FTBS, the maintainer would definitely want to do something to fix this. Maybe a lot of these bugs are not really applicable or a rebase already fixed them, so all that is required is to close the bug with an approproate explanation.

Making Fedora secure - Package exit policy for security

://bugzilla.redhat.com/buglist.cgi?bug_status=NEW_status=ASSIGNED=Fedora=SecurityTracking%2C%20_type=allwords_id=9076731=changeddate%2Cpriority%2Cbug_id=Fedora_based_on=_format=advanced -- Huzaifa Sidhpurwala / Red Hat Product Security Team ___ devel mailing list

Re: F22 System Wide Change: Enable Polyinstantiated /tmp and /var/tmp directories by default

in the general case. This idea can only fly for very special systems where the propagation is irrelevant. It's not compatible with admin workflows, at all. Lennart -- Huzaifa Sidhpurwala / Red Hat Product Security Team -- devel mailing list devel@lists.fedoraproject.org https

Re: usb-modeswitch/usb-modeswitch-data must be updated (hardware related)

I will update both the components today. Thanks! - Original Message - From: Xose Vazquez Perez xose.vazq...@gmail.com To: Development discussions related to Fedora devel@lists.fedoraproject.org Sent: Monday, October 24, 2011 10:00:58 PM Subject: usb-modeswitch/usb-modeswitch-data must be

Re: usb_modeswitch/usb_modeswitch-data outdated

On 07/25/2011 07:17 AM, Kevin Fenzi wrote: Do file a bug to alert the maintainer(s) that they should update and why. taken care of this, sorry for the delay :) -- devel mailing list devel@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel

Re: NetworkManager to reconnect silently

Is there a way to tell NM not to ask for a new password ever? Because I use a 63-symbol passphrase once set up on all the (two) machines so to forget about it. Store the password in gnome-keyring-manager? -- devel mailing list devel@lists.fedoraproject.org

Re: WebKit(s) SIG

Hi, If you're interested in - please reply, I'd like to start Wiki page and we can talked about more details etc. Count me in :) Regards, Huzaifa Sidhpurwala -- devel mailing list devel@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel

Re: gethostbyname() and resolv.conf updates

, unless its upstream. Looking at the thread at: http://sources.redhat.com/ml/libc-alpha/2004-09/msg00109.html it does not appear this patch would make it upstream though. - -- Regards, Huzaifa Sidhpurwala, RHCE, CCNA (IRC: huzaifas) GnuPG Fingerprint: 3A0F DAFB 9279 02ED 273B FFE9 CC70 DCF2 DA5B

Re: usb_modeswitch 1.1.2 in Fedora 11

Hi Bernie, Works for me, Since you are already a provenpackager i dont think you need explicit cvs access on that package, so i would say go ahead and thanks for doing it. Regards, Huzaifa Sidhpurwala. - Original Message - From: Bernie Innocenti ber...@codewiz.org To: Huzaifa

Re: New improved usb_modeswitch coming your way !!

David Woodhouse wrote: On Wed, 2010-04-21 at 14:03 +0530, Huzaifa Sidhpurwala wrote: I would rather patch the tcl script to use the binary in /usr/bin :) Unless people thing otherwise. Why deviate from what upstream does, which is to use /usr/sbin? This is fixed now in https

New improved usb_modeswitch coming your way !!

://admin.fedoraproject.org/updates/usb_modeswitch-1.1.2-1.fc12,usb_modeswitch-data-20100418-2.fc12 https://admin.fedoraproject.org/updates/usb_modeswitch-data-20100418-2.fc13,usb_modeswitch-1.1.2-1.fc13 -- Regards, Huzaifa Sidhpurwala, RHCE, CCNA (IRC: huzaifas) GnuPG Fingerprint: 3A0F DAFB 9279 02ED

Re: New improved usb_modeswitch coming your way !!

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David Woodhouse wrote: On Wed, 2010-04-21 at 12:15 +0530, Huzaifa Sidhpurwala wrote: So i split up usb_modeswitch into the main package and the data part, now called usb_modeswitch and usb_modeswitch-data. The version in testing is latest

Query about usb_modeswitch and how to handle its packaging

you think is the best option. Thanks in advance. - -- Regards, Huzaifa Sidhpurwala, RHCE, CCNA (IRC: huzaifas) GnuPG Fingerprint: 3A0F DAFB 9279 02ED 273B FFE9 CC70 DCF2 DA5B DAE5 -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Red Hat - http

Re: Using capabilities for libpcap apps

cap_net_raw,cap_net_admin+eip /usr/bin/tshark Suggestions? Ideas? Spec file patches? Any help is welcome. Radek - -- Regards, Huzaifa Sidhpurwala, RHCE, CCNA (IRC: huzaifas) GnuPG Fingerprint: 3A0F DAFB 9279 02ED 273B FFE9 CC70 DCF2 DA5B DAE5 -BEGIN PGP SIGNATURE- Version: GnuPG

Re: Using capabilities for libpcap apps

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Huzaifa Sidhpurwala wrote: Ah Sorry, scratch the last line please, an oversight :) I would suggest using libpcap-ng rather than libpcap if it works. - -- Regards, Huzaifa Sidhpurwala, RHCE, CCNA (IRC: huzaifas) GnuPG Fingerprint: 3A0F DAFB 9279

Re: usb_modeswitch by default

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Rahul Sundaram wrote: Just to clarify, does ModemManager need to depend on usb_modeswitch? It currently does not. Dan, I guess its not such a bad idea to make it depend? Rahul - -- Regards, Huzaifa Sidhpurwala, RHCE, CCNA (IRC: huzaifas

Re: Orphaning Packages

@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/devel - -- Regards, Huzaifa Sidhpurwala, RHCE, CCNA (IRC: huzaifas) IT Desktop RD Lead. Global Help Desk, Pune (India) Phone: +91 20 4005 7322 (UTC +5.5) GnuPG Fingerprint: 3A0F DAFB 9279 02ED 273B FFE9 CC70 DCF2 DA5B DAE5 -BEGIN

Re: usb_modeswitch by default

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I have taken over the maintainership from Robert, and the new usb_modeswitch rpms are in rawhide now. Let me know if you guys need anything fixed on that :) - -- Regards, Huzaifa Sidhpurwala, RHCE, CCNA (IRC: huzaifas) IT Desktop RD Lead

Re: Sindre Pedersen Bjørdal is AWOL, 25 packa ges looking for new owners

-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 * firewalk -- Active reconnaissance network security tool * httptunnel -- Tunnels a data stream in HTTP requests * nikto -- Web server scanner Taken these :) - -- Regards, Huzaifa Sidhpurwala, RHCE, CCNA (IRC: huzaifas