4 ms·

Probably resurfacing, because we have some new attacks thanks to CCC. [0] [0] https://news.ycombinator.com/item?id=46453461 https://news.ycombinator.com/item?i

• shakna 10mo ago
  Worth noting: minisign and age were also affected by a couple things here. GnuPG has decided a couple things are out of scope, fixed a couple others. Not all is in distro packages yet. age didn't have the clearest way to report things - discord is apparently the point of contact. Which will probably improve soon. minisign was affected by most everything GnuPG was, but had a faster turnaround to patching.
  • stackghost 10mo ago
    The mark of good security is not "has no bugs". It's how the maintainers respond to security-relevant bugs.
    • F3nd0 10mo ago
      … in which case, ‘on Discord’ is not off to a good start.
      • anthk 10mo ago
        Indeed. A mail list plus IRC would be a better start. Go runs on far more platforms than Discord. And, worse, Discord it's propietary.
  • tptacek 10mo ago
    The minisign bug was much less severe than the (insane) GPG signing bugs, and the age bug wasn't a cryptographic thing at all, just a dumb path sanitization thing. Minisign was not in fact affected by most everything GPG was. The GnuPG team wontfixed one of the most significant bugs!
• croemer 10mo ago
  Indeed, I saw it linked to in that thread, read it and thought it'd be worth resurfacing.