mainSavannah Administration - Support: sr #111331, received GPG-encrypted spam as new...

 
 

sr #111331: received GPG-encrypted spam as new Savannah ticket

Submitter:  G. Branden Robinson <gbranden>
Submitted:  Tue 28 Oct 2025 12:10:18 AM UTC
   
 
Category:  Savannah trackers - bugs, tasks, etc. Priority:  5 - Normal
Severity:  3 - Normal Status:  Postponed
Privacy:  Public Assigned to:  ineiev
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Post a Comment

Add a New Comment Rich Markup
   

Discussion

Wed 29 Oct 2025 11:34:27 PM UTC, comment #2: 

At 2025-10-29T13:30:34-0400, Ineiev wrote:

> You can mark the bugs as spam, and they'll be hidden by default.
>
> Currently, notifications of anonymous posts and posts of new users are
> sent to sv-hackers-private@; their volume is low enough for me to just
> look through them and mark spam in the Web UI.  Spam is relatively
> rare as far as I can tell, thank the dog.  And generally, encrypted
> spam should make less sense because it can only be read by the
> addressees.


I don't think this message was spam in the "unsolicited commercial
email" sense.  Given the blatant error involving confusion of maintainer
identity--why address the message verbally to Bertrand but use my GPG
key?--I suspect some kind of robotic probe, some sort of {f,ph}ishing.

I am therefore uncertain if we want to categorize this as "spam" or not.

Whatever it was, it was non-actionable.  The submitter was not signed
into Savannah when submitting and offered no contact information.  If
they really do have a security vulnerability to report, they offered me
no avenue for obtaining its description.

G. Branden Robinson <gbranden>
Wed 29 Oct 2025 05:30:29 PM UTC, comment #1: 

You can mark the bugs as spam, and they'll be hidden by default.

Currently, notifications of anonymous posts and posts of new users are sent to sv-hackers-private@; their volume is low enough for me to just look through them and mark spam in the Web UI.  Spam is relatively rare as far as I can tell, thank the dog.  And generally, encrypted spam should make less sense because it can only be read by the addressees.

Ineiev <ineiev>
Site Administrator
Tue 28 Oct 2025 12:10:18 AM UTC, original submission:  

This is more of a heads-up to Savannah administrators than anything.  Off the top of my head I'm not sure what countermeasures can be implemented that wouldn't foreclose potentially legitimate attempts to discreetly report a security vulnerability in a Savannah project.

See groff bug #67640 and bug #67641.

If the only action to resolve this is for the admins to take note of it (and maybe check the inbound IP addresses of the web session(s) that produced it for any remarkable properties), I'm fine with that.

I guess this message can also serve as part of an audit trail in the event this/these was/were (a) legitimate attempt at (a) report(s), recording that I erroneously categorized the message.

I note that usually people misspell my name as "Brandon".  Misspelling it as "Bertrand Garrigues" sets a new Levenshtein distance record in this domain.  Gold medal!

G. Branden Robinson <gbranden>

 

Attached Files

This item currently has no attached files.

(Note: upload size limit is set to 4.0MiB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

 

Dependencies

This item does not depend on any other items.

No items depend on this one.

 

Mail Notification Carbon-Copy List

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by gbranden (Submitted the item)
  •  

    Votes

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    History

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2025-11-11 ineiev StatusIn Progress Postponed
        Open/ClosedOpen Closed
    2025-10-29 ineiev StatusNone In Progress
        Assigned toNone ineiev

    Back to the top

    Powered by Savane 3.16-11ef.
    Corresponding source code