Solved When to report security flaws to the Security Officer Team vs the FreeBSD Security Team?

epower53

epower53

I believe I've uncovered a security issue in 15.1-RELEASE during my homelab setup journey. According to the FreeBSD security reporting page, there are two channels for letting the security team know about this:
  1. send a plain-text email to the FreeBSD Security Team
  2. send a PGP-encrypted email to the Security Officer Team​
The page doesn't give a lot of guidance on which channel to use - the only text I can cite says "if a higher level of confidentiality is required, PGP encrypted to the Security Officer Team using the Security Officer PGP key."

My question: how do I determine if a higher level of confidentiality is required? The flaw looks serious enough to me that I won't be posting any details or hints anywhere public. However, I'm not sure if it rises to the level of requiring encrypted communication.
 
Most email flows encrypted on the wire these days. If you don't have PGP set up yet it might be better to email now instead of tangling with mail encryption for days.
 
You must log in or register to reply here.
Back
Top