1 # SOME DESCRIPTIVE TITLE
2 # Copyright (C) YEAR Free Software Foundation, Inc.
3 # This file is distributed under the same license as the PACKAGE package.
4 # FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
9 "Project-Id-Version: PACKAGE VERSION\n"
10 "POT-Creation-Date: 2014-07-23 00:06+0300\n"
11 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
12 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
13 "Language-Team: LANGUAGE <LL@li.org>\n"
16 "Content-Type: text/plain; charset=UTF-8\n"
17 "Content-Transfer-Encoding: 8bit\n"
21 msgid "[[!meta title=\"On 0days, exploits and disclosure\"]]\n"
26 msgid "[[!meta date=\"Tue Jul 22 21:40:00 2014\"]]\n"
31 "A [recent tweet](https://twitter.com/ExodusIntel/status/491247299054428160) "
32 "from Exodus Intel (a company based in Austin, Texas) generated quite some "
33 "noise on the Internet:"
39 "> \"We're happy to see that TAILS 1.1 is being released tomorrow.\n"
40 "> Our multiple RCE/de-anonymization zero-days are still effective. #tails #tor\"\n"
45 "Tails ships a lot of software, from the Linux kernel to a fully functional "
46 "desktop, including a web browser and a lot of other programs. Tails also "
47 "adds a bit of custom software on top of this."
52 "Security issues are discovered every month in a few of these programs. Some "
53 "people report such vulnerabilities, and then they get fixed: This is the "
54 "power of free and open source software. Others don't disclose them, but run "
55 "lucrative businesses by weaponizing and selling them instead. This is not "
56 "new and [comes as no surprise](https://www.eff.org/deeplinks/2012/03/zero-"
57 "day-exploit-sales-should-be-key-point-cybersecurity-debate)."
62 "We were not contacted by Exodus Intel prior to their tweet. In fact, a more "
63 "irritated version of this text was ready when we finally received an email "
64 "from them. They informed us that they would provide us with a report within "
65 "a week. We're told they won't disclose these vulnerabilities publicly before "
66 "we have corrected it, and Tails users have had a chance to upgrade. We think "
67 "that this is the right process to responsibly disclose vulnerabilities, and "
68 "we're really looking forward to read this report."
73 "Being fully aware of this kind of threat, we're continously working on "
74 "improving Tails' security in depth. Among other tasks, we're working on a "
75 "[tight integration](https://labs.riseup.net/code/projects/tails/search?"
76 "q=apparmor) of AppArmor in Tails, [[!tails_ticket desc=\"kernel\" 7639]] "
77 "and [[!tails_ticket desc=\"web browser hardening\" 5802]] as well as [[!"
78 "tails_ticket desc=\"sandboxing\" 6081]], just to name a few examples."
83 "We are happy about every contribution which protects our users further from "
84 "de-anonymization and helps them to protect their private data, "
85 "investigations, and their lives. If you are a security researcher, please "
86 "audit Tails, Debian, Tor or any other piece of software we ship. To report "
87 "or discuss vulnerabilities you discover, please get in touch with us by "
88 "sending email to <tails@boum.org>."
93 "Anybody wanting to contribute to Tails to help defend privacy, [[please join "