nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
During the audit, we noticed that we lacked a policy about when we should make confidential security issues public.
Durant l'audit, nous avons remarqué un manque de politique autour de la diffusion au public des problèmes de sécurité.
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Policy and culture improvements
Améliorations politiques et culturels
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
We will also periodically audit the configuration of `onion-grater`, our
firewall for the Tor control port. ([[!tails_ticket 20821]])
Nous auditerons aussi périodiquement la configuration de `onion-grater`,
notre pare-feu pour le contrôle de port Tor. ([[!tails_ticket 20821]])
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Our CI now ensures that we don't write software that does unsafe `.desktop`
file lookup.
Notre intégration continue s'assure qu'on nous n'écrivions pas de logiciel effectuant
une recherche de fichiers `.desktop`non sécurisée.
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Postmortem of OTF-004 ([[!tails_ticket 20817]] and [[!tails_mr 2040]])
Postmortem de OTF-004 ([[!tails_ticket 20817]] et [[!tails_mr 2040]])
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Our `sudo` configuration is now generated from a higher-level description,
which has safer defaults and demands explanations when diverging
from them.
Notre configuration `sudo` est maintenant générée depuis une description haut niveau,
qui a des valeurs par défauts plus sures et demande des explications quand elle diverge
de ces derniers.
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Postmortem of OTF-003 ([[!tails_ticket 20711]] and [[!tails_mr 1979]])
Postmortem de OTF-003 ([[!tails_ticket 20711]] et [[!tails_mr 1979]])
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Our CI now ensures that all our custom Python software runs in
isolated mode.
Notre intégration continue assure maintenant que notre logiciel Python personnalisé
s'execute dans un mode isolé.
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Postmortem of OTF-002 ([[!tails_ticket 20719]] and [[!tails_mr 1911]])
Postmortem de OTF-002 ([[!tails_ticket 20719]] et [[!tails_mr 1911]])
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
for potentially vulnerable Mite code and fail the build if we find any.
pour de potentielles vulnérabilités de code Mite et mettons en echec l'execution si nous en trouvons.
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
[[!tails_gitweb config/chroot_local-hooks/99-zzz_check_mite desc="automatically check"]]
[[!tails_gitweb config/chroot_local-hooks/99-zzz_check_mite desc="vérifions automatiquement"]]
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Furthermore, we now
De plus, nous
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
While preparing a major Tails release based on a new version of Debian, for example, Tails 7.0,
we will look for Perl code included in Tails
that modifies `@INC` in a dangerous way. ([[!tails_ticket 19627]])
Durant la préparation d'une importante mise à jour de Tails se basant sur une nouvelle version de Debian,
par exemple, Tails 7.0, nous regarderons le code Perl inclus dans Tails qui modifie `@INC` de façon dangereuse. ([[!tails_ticket 19627]])
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Postmortem of OTF-001
Postmortem de OTF-001
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Technical improvements
Améliorations techniques
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
This analysis was useful and we'll definitely consider doing postmortems again after future audits. It might also be useful for other projects to understand how we worked on these long-lasting improvements.
Cette analyse a été utile et nous allons définitivement considérer faire plus de postmortem dans le futur. Il serait aussi intéressant pour d'autres projets de comprendre comment nous avons travaillé sur ces améliorations durables.
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Our team went further than simply fixing these issues. We conducted a *postmortem* to understand *how* we introduced these vulnerabilities in our releases and *what* we could do to avoid similar vulnerabilities in the future. This analysis led to technical, policy, and culture changes.
Notre équipe n'a pas seulement résolu ces problèmes. Nous avons créé un *postmortem* pour comprendre *comment* nous avons introduit ces vulnérabilités dans nos versions, et *comment* empêcher des vulnérabilités similaires dans le futur. Cette analyse a ammené des changements techniques, culturels et politiques.
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Postmortem
Postmortem
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
<table>
<tr><th>ID</th><th>Impact</th><th>Description</th><th>Issue</th><th>Status</th><th>Release</th></tr>
<tr><td>OTF-001</td><td>High</td><td>Local privilege escalation in <i>Tails Upgrader</i></td><td>[[!tails_ticket 20701]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td>OTF-002</td><td>High</td><td>Arbitrary code execution in Python scripts</td><td>[[!tails_ticket 20702]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td> </td><td></td><td></td><td>[[!tails_ticket 20744]]</td><td>Fixed</td><td>6.12</td></tr>
<tr><td>OTF-003</td><td>Moderate</td><td>Argument injection in privileged GNOME scripts</td><td>[[!tails_ticket 20709]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td> </td><td></td><td></td><td>[[!tails_ticket 20710]]</td><td>Fixed</td><td>6.11</td></tr>
<tr><td>OTF-004</td><td>Low</td><td>Untrusted search path in Tor Browser launcher</td><td>[[!tails_ticket 20733]]</td><td>Fixed</td><td>6.12</td></tr>
</table>
<table>
<tr><th>ID</th><th>Impact</th><th>Description</th><th>Lien</th><th>Statut</th><th>Version</th></tr>
<tr><td>OTF-001</td><td>Élevé</td><td>Escalation local de privilège dans <i>Tails Upgrader</i></td><td>[[!tails_ticket 20701]]</td><td>Résolu</td><td>6.11</td></tr>
<tr><td>OTF-002</td><td>Élevé</td><td>Execution de code arbitraire dans les scripts Python</td><td>[[!tails_ticket 20702]]</td><td>Résolu</td><td>6.11</td></tr>
<tr><td> </td><td></td><td></td><td>[[!tails_ticket 20744]]</td><td>Résolu</td><td>6.12</td></tr>
<tr><td>OTF-003</td><td>Moyen</td><td>Injection d'argument dans un script privilégié GNOME</td><td>[[!tails_ticket 20709]]</td><td>Résolu</td><td>6.11</td></tr>
<tr><td> </td><td></td><td></td><td>[[!tails_ticket 20710]]</td><td>Résolu</td><td>6.11</td></tr>
<tr><td>OTF-004</td><td>Faible</td><td>Chemin de recherche non fiable dans le gestionnaire de Tor Browser</td><td>[[!tails_ticket 20733]]</td><td>Résolu</td><td>6.12</td></tr>
</table>
4 weeks ago
nandicre

Suggestion added

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Other important changes since [[Tails 5.8|version_5.8]] (November 2023)
Dautres changements importants depuis [[Tails 5.8|version_5.8]] (Novembre 2023)
4 weeks ago

Search