Trying to get in touch regarding a security issue about kubeflow HOT 9 CLOSED

@akgraner would your team please add this to the next Kubeflow Security Team's meeting agenda ? thank you.

from kubeflow.

from kubeflow.

@akgraner @jbottum just following up here, did we get any updates from @psmoros?

Also, we probably need to set up a secure way for people to report issues (e.g. HackerOne, which we get free with the CNCF).

from kubeflow.

@thesuperzapper thank you for that suggestion. We are aware and are working with the CNCF to get an email address for that purpose.

from kubeflow.

@psmoros - Can you reach out to me and @juliusvonkohout via slack (akgraner) so we can set up a meeting with you an a couple other members of the security team. And can you also email us more information at [email protected] and [email protected] about the issue.

Our next security meeting is 16 January 2024. Below is the meeting information.

Join Zoom Meeting
https://us06web.zoom.us/j/87118537300?pwd=NG5ibWN0N2YxUGR5Y2NXSXRiN0FGZz09

Meeting ID: 871 1853 7300
Passcode: 273734

from kubeflow.

@psmoros

We are working with CNCF folks to get a policy and a reporting email in place. However, I'll see if we can get a reporting addresses sooner rather than later. Thank you.

from kubeflow.

@akgraner many security researchers oppose using email disclosures for a number of reasons:

1. Encryption: emails are inherently not secure and can be intercepted
2. Phishing/Leaks: allowing security researchers to send arbitrary attachments is a recipe for it to get hacked (potentially exposing all the other pending vulnerabilities)
3. Tracking: it can be unclear if the project has seen the disclosure, and so when it would be appropriate to publicly disclose if no action is taken (typically 90 days)
4. Verification: it makes getting payments/recognition for anonymous disclosures impossible (we can't identify who's sending)
5. Access Control: Enforcing access control on the triage end is very hard
6. Standardization: we can't enforce any kind of structure to the report

Most large projects either use HackerOne or GitHub's in built disclosures feature.

from kubeflow.

from kubeflow.

Thanks @akgraner will do :))

from kubeflow.