Releasing 1.0.29.

[wiki] / security.mdwn

diff --git a/security.mdwn b/security.mdwn
index 04a940e..aa05ea3 100644 (file)
--- a/security.mdwn
+++ b/security.mdwn
@@ -1,10 +1,16 @@
+## Reporting security issues
+
+In case you have found a security issue in tinc, please report it via email
+to Guus Sliepen <guus@tinc-vpn.org>, preferrably PGP encrypted.
+We will then try to get a CVE number assigned, and coordinate a bugfix release with major Linux distributions.
+
 ## Security advisories
 
 The following list contains advisories for security issues in tinc in old versions:
 
 - [CVE-2013-1428](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1428),
-  [DSA-2663](http://www.debian.org/security/2013/dsa-2663),
-  [sitsec advisory](http://sitsec.net/blog/2013/04/22/stack-based-buffer-overflow-in-the-vpn-software-tinc-for-authenticated-peers):
+  [DSA-2663](https://www.debian.org/security/2013/dsa-2663),
+  [Sitsec advisory](http://sitsec.net/blog/2013/04/22/stack-based-buffer-overflow-in-the-vpn-software-tinc-for-authenticated-peers):
   stack based buffer overflow
 
 - [CVE-2002-1755](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1755):
@@ -18,7 +24,7 @@ The following list contains advisories for security issues in tinc in old versio
 For those who run tinc on Debian or Debian-based distributions like
 Ubuntu and Knoppix, be advised that the following security issue
 affects tinc as well:
-[http://www.debian.org/security/2008/dsa-1571](http://www.debian.org/security/2008/dsa-1571)
+[https://www.debian.org/security/2008/dsa-1571](https://www.debian.org/security/2008/dsa-1571)
 In short, if you generated public/private keypairs for tinc between
 2006 and May 7th, 2008 on a machine running Debian or a derivative,
 they may have been generated without a properly seeded random