Comments (13)
Now I understood that you used my personal email address for this (getting edit access). Please don't do that for such "public documents": I don't want to receive spam in there. In the order of preference, please use my github ID, my public github email address (57787676+baentsch@...) or the private one I created only for GH interactions (info@....). I guess when that's changed I'll also get to see questions and can respond.
from oqs-provider.
Thanks, @anvega -- problem's resolved.
from oqs-provider.
Apologies for the mix up with the document versions. I've now updated the Security Issue Resolution section to reflect the changes in the latest version.
I've also removed your personal email address and used the info@... address for Google access since the GH one wasn't accepted by Google.
Regarding your inability to see the comments, you should be able to view them even with just viewing access. Try clicking on View > Comments > Expand all comments. If this doesn't work, I can relay the questions to you via another method, such as a markdown file.
from oqs-provider.
First cut below. It would be great if you could take a look and maybe provide actionable feedback @anvega . Most things are pretty obvious but I'm feeling an ethical obligation to first witness more committed contributors before implementing/declaring as "good" things this self-assessment suggests. Otherwise, I'd be afraid this would create a false sense of reliability to users ("badges", "alliance endorsement", etc marketing fluff) -- all the while the code is maintained thanklessly by the proverbial random guy in Nebraska (err, Switzerland :).
oqsprovider-self-assessment-20240726.md
from oqs-provider.
@anvega Thanks for taking up this initial self-assessment. @dstebila by now corrected my incomplete understanding and reference as to the responsibilities of the LF triage team and I'll need to update that section once I better understand how it's been set up by LF.
@ryjones : Can you shed some light on this? Who gets notified if someone "privately" reports a vulnerability via GH? Is this going to the maintainers? Is (handling that) part of the undocumented responsibilities of LF maintainers? Who else gets these notifications? You as LF admin?
from oqs-provider.
Organization administrators, repository administrators, and teams with the security manager role
These teams are security managers:
from oqs-provider.
Thanks for the explanation, @ryjones . This seems a bit broad and completely contradicting the public documentation indicating a "responsibly small" set (only admins) to see this:
Created open-quantum-safe/tsc#60 to track/improve. Tagging @dstebila @hartm as meeting follow-up.
@anvega : Updated oqsprovider-self-assessment-20240731.md to properly document this.
from oqs-provider.
The project can make that list as large or small as they like. If you want to create a specific team for security, you can do that, and I'll replace the current list with that one.
from oqs-provider.
Thanks @baentsch and @ryjones.
I've converted the markdown to Google Docs for easier commenting. I've also completed my first pass with some initial naive questions. As a recommendation through the assessment, I suggest rephrasing the text where questions might arise, to preemptively address them rather than discussing them in the comments. This approach ensures that when we convert back to markdown, the content is there
A few more people have shown interest in participating in the review. I'm waiting for formal approval from @JustinCappos to initiate the joint assessment process. Once approved, Iād like to give the reviewers a chance to ask their initial questions before we convene for a group discussion with you the project team, and the other reviewers.
from oqs-provider.
I've also completed my first pass with some initial naive questions.
How/where do I see those questions? How could I comment on them? I see the Google doc, but can't seem to change "Mode" or "Comments".
from oqs-provider.
Oh, and the underlying document is the wrong (old) version. Please use the new version labelled 20240731 attached above, @anvega .
from oqs-provider.
@baentsch I have added my Qs in the same doc, please see and clarify. Thank you.
from oqs-provider.
@dehatideep Thanks for your questions. Please check whether my answers in the doc are clear enough or whether I need to provide more background.
from oqs-provider.
Related Issues (20)
- tlssig test takes huge amount of time HOT 11
- The privateKey encoding for pure ml-dsa differs from the privateKey encoding for the ml-dsa part in composite ml-dsa-xxxx HOT 10
- Various warnings building OQS Provider on Mac HOT 1
- How to generate .cert and .key files for XMSS and LMS algorithm using oqs-provider? HOT 1
- How to generate .cert and .key files for XMSS and LMS algorithm using oqs-provider?
- TLS sig tests failing when OQS_KEM_ENCODERS=ON HOT 2
- CI upgrade breaks clang formatting and asan testing
- Extracting quantum-resistant keys and classical keys from a composite key. HOT 5
- Missing Composite documentation HOT 1
- DRBG ERROR? HOT 1
- Handshake Failures with Post-Quantum Certificates on SCTP & DTLS 1.2 HOT 6
- Windows: Build fails when using OQS_MINIMAL_BUILD HOT 2
- Reliability
- Document & test the new/3.4.0 encap/decap feature HOT 1
- Testing in openssl 3.1/3.0
- Add code coverage testing
- oqs-provider debian package lists statically linked liboqs as a requirement HOT 3
- Cannot use dilithium certificates with s_server HOT 1
- Unknown certificate type HOT 5
- oqs provider on windows HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
š Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. ššš
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ā¤ļø Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from oqs-provider.