You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
We are contacting SecureDrop instances through all available channels to remind them to upgrade to Ubuntu 16.04. However, after April 30, some instances will almost certainly remain on Trusty.
Per #4305, the source interface will be disabled on those instances. We will recommend that they follow the Back Up, Restore, Migrate procedure, given that the base OS can no longer be assumed to be secure at that point. If we become aware of exploitable vulnerabilities, we will have to recommend a full reinstall (with .onion address change), given the potential for a private key compromise of the hidden services.
At minimum, we need to have the following docs changes and comms ready to go for May 1:
Update to the docs to make it clear that the in-place upgrade is no longer recommended;
Advisory for instances running 14.04 that recaps what has happened (source interface is disabled, OS is EOL, etc.) and how to resolve.
In the advisory, we may want to include language recommending an internal review whether SecureDrop is the right system for the organization, given its maintenance requirements, and offer to help with such an evaluation.
The text was updated successfully, but these errors were encountered:
We are contacting SecureDrop instances through all available channels to remind them to upgrade to Ubuntu 16.04. However, after April 30, some instances will almost certainly remain on Trusty.
Per #4305, the source interface will be disabled on those instances. We will recommend that they follow the Back Up, Restore, Migrate procedure, given that the base OS can no longer be assumed to be secure at that point. If we become aware of exploitable vulnerabilities, we will have to recommend a full reinstall (with .onion address change), given the potential for a private key compromise of the hidden services.
At minimum, we need to have the following docs changes and comms ready to go for May 1:
In the advisory, we may want to include language recommending an internal review whether SecureDrop is the right system for the organization, given its maintenance requirements, and offer to help with such an evaluation.
The text was updated successfully, but these errors were encountered: