Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create advisory and revise docs for instances running Trusty after April 30 #4322

Closed
2 tasks done
eloquence opened this issue Apr 4, 2019 · 1 comment
Closed
2 tasks done
Labels

Comments

@eloquence
Copy link
Member

eloquence commented Apr 4, 2019

We are contacting SecureDrop instances through all available channels to remind them to upgrade to Ubuntu 16.04. However, after April 30, some instances will almost certainly remain on Trusty.

Per #4305, the source interface will be disabled on those instances. We will recommend that they follow the Back Up, Restore, Migrate procedure, given that the base OS can no longer be assumed to be secure at that point. If we become aware of exploitable vulnerabilities, we will have to recommend a full reinstall (with .onion address change), given the potential for a private key compromise of the hidden services.

At minimum, we need to have the following docs changes and comms ready to go for May 1:

  • Update to the docs to make it clear that the in-place upgrade is no longer recommended;
  • Advisory for instances running 14.04 that recaps what has happened (source interface is disabled, OS is EOL, etc.) and how to resolve.

In the advisory, we may want to include language recommending an internal review whether SecureDrop is the right system for the organization, given its maintenance requirements, and offer to help with such an evaluation.

@eloquence
Copy link
Member Author

This was completed on May 1; the advisory was posted here:
https://securedrop.org/news/advisory-securedrop-no-longer-accepting-submissions-now-what/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant