Expected response time? Two days passed since reporting low-medium issue. PGP encrypted email. Should add response time to docs.
Discussed internally. Likely invalid / low impact.
That specific one, feel free to post in public forums.
Reported two more things, one three days ago. They should be more relevant than previous. Adding expected response time to docs may be good. Can decrease user confusion on appropriate time to respectfully remind.
- two: low priority, unconfirmed, feel free to post in public
- three: feel free to post in public, long-standing documented design limitation → Connections between Whonix-Gateway ™ and Whonix-Workstation ™
As for the response timing:
Quote Vulnerability Disclosure Policy - Project Zero
90+30 policy
I think @viajred is referring to time-to-acknowledgement. 90+30 makes sense for public disclosure of confirmed vulns but sounds a bit long to acknowledge receipt of a report prior to confirmation. (Debian’s security team doesn’t have a documented time-to-acknowledgement, and I have waited for a long time waiting for them to respond to emails I sent that I later found out went to spam.)
1 Like
Yes. Hard to tell if email was received. Perhaps: “Try reaching out if no response in X days”. Or similar.
Must softly disagree, request clarification. Read the page. Issue has nothing to do with MITM or other issues with security of connection between GW/WS. No insecure link required. POC run with stock Whonix, not a modified connection version. Authenticated/encrypted connection does not seem to have any relevance. The stock Whonix WS interacted correctly with stock GW, same correct interaction would occur with auth/encryption. Please, examine again.
https://www.whonix.org/wiki/Features#cite_note-14
If Whonix-Workstation (
anon-whonix) is rooted, the adversary cannot find out the user’s real IP address / location. The reason is Whonix-Workstation (anon-whonix) can only connect through the Whonix-Gateway™ (sys-whonix).
Seems only Workstation root malware required to induce Gateway to send clearnet packet to malware chosen destination.
Admit I can be wrong. If you are sure, I will post in public.
Will reconsider.
Had time?
Still looking into it internally. We’ll post an update once we’re done.
What causes delay? Hard to fix, upstream problems, assigned low-priority, disclosure policy? Seeking feedback for knowledge, not intending rudeness. More reports like it welcomed?
I don’t have the full picture here since I didn’t see the vulnerability report, but I do know we’re working on a new release (getting pretty close to completion, polishing lots of under-the-hood stuff and introducing preliminary support for reproducible builds), and we don’t want to go public with details of something we think could be a real issue until after a release is out that fixes the issue. Our release process and code organization makes it a bit tricky to do hotfix releases when we have lots of changes in the queue, so my guess is that’s the main thing holding it up.
Very likely yes.
1 Like
Private email update should not be problem? Since I am reporter. As heavy Whonix user, am also concerned awaiting update. Feedback improves reporter ability/taste.
It’s not reproduced (yet).
But it’s prudent to harden the related code in any case. A hardened version will be released soon.
1 Like
Checked git. Seems you fixed and released. I can publish third report on this forum for documentation now?
POC ran on VBox, before your fix. After fix it is patched.
1 Like
Only updated packages. It’s pending new image releases on all platforms.
(Release announcement will provide authorship recognition as well btw.)