None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
As a temporary measure, this protected our users by erring on the safe
side. But, without a disclosure process, we were not meeting our own
standards for transparency and openness to third-party reviews.
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
We have sometimes been too secretive.
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
This was problematic because:
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
During the audit, we noticed that we lacked a policy about when we should make confidential security issues public.
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Policy and culture improvements
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
We will also periodically audit the configuration of `onion-grater`, our
firewall for the Tor control port. ([[!tails_ticket 20821]])
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Our CI now ensures that we don't write software that does unsafe `.desktop`
file lookup.
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Postmortem of OTF-004 ([[!tails_ticket 20817]] and [[!tails_mr 2040]])
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Our `sudo` configuration is now generated from a higher-level description,
which has safer defaults and demands explanations when diverging
from them.
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Postmortem of OTF-003 ([[!tails_ticket 20711]] and [[!tails_mr 1979]])
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Our CI now ensures that all our custom Python software runs in
isolated mode.
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Postmortem of OTF-002 ([[!tails_ticket 20719]] and [[!tails_mr 1911]])
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
for potentially vulnerable Mite code and fail the build if we find any.
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
[[!tails_gitweb config/chroot_local-hooks/99-zzz_check_mite desc="automatically check"]]
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Furthermore, we now
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
While preparing a major Tails release based on a new version of Debian, for example, Tails 7.0,
we will look for Perl code included in Tails
that modifies `@INC` in a dangerous way. ([[!tails_ticket 19627]])
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Postmortem of OTF-001
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Technical improvements
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
This analysis was useful and we'll definitely consider doing postmortems again after future audits. It might also be useful for other projects to understand how we worked on these long-lasting improvements.
 
3 weeks ago
None

String updated in the repository

  1. Tails
  2. wiki/src/news/audit_by_ROS_2024.*.po
  3. French
Our team went further than simply fixing these issues. We conducted a *postmortem* to understand *how* we introduced these vulnerabilities in our releases and *what* we could do to avoid similar vulnerabilities in the future. This analysis led to technical, policy, and culture changes.
 
3 weeks ago

Search