[Predisclosure-applications] SecureDrop / Freedom of the Press Foundation request

[Jennifer Helsby <jen@freedom.press>]

Hello list members,

SecureDrop / Freedom of the Press Foundation would like to apply to join the Xen pre-disclosure list.

As background, SecureDrop is a whistleblowing platform used by dozens of news organizations including the Washington Post and the
New York Times to accept and triage tips from journalistic sources. It is currently supported by Freedom of the Press Foundation.

> The name of your organization: 
Freedom of the Press Foundation

> Domain name(s) which you use to provide Xen software/services: 
https://securedrop.org, https://freedom.press 

> A brief description of why you fit the criteria: 

The SecureDrop Workstation (https://github.com/freedomofpress/securedrop-workstation/) is a product used by
journalists at news organizations which relies on the security and isolation properties of the Xen hypervisor (via QubesOS)
for opening potentially malicious documents submitted to the tipline in order to protect other submissions and sensitive
information on journalist workstations.

> If not all of your products/services use Xen, a list of (some of) your products/services (or categories thereof) which do.
 
Only the SecureDrop workstation is based on Xen via QubesOS (https://qubes-os.org).
 
> Link(s) to current public web pages, belonging to your organisation, for each of following pieces of information:

> Evidence of your status as a service/software provider:

Freedom of the Press Foundation develops and maintains several open source projects such as SecureDrop and the SecureDrop workstation.
You can see the main text on https://securedrop.org and https://freedom.press as evidence of this. In addition, news organizations that wish to contract
with us for paid support services can do so here: https://securedrop.org/help/. 

> If you are a public hosting provider, your public rates or how to get a quote: 
N/A

> If you are a software provider, how your software can be downloaded or purchased: 

Download and install QubesOS (https://qubes-os.org) and install the SecureDrop workstation following the documentation in
the README at: https://github.com/freedomofpress/securedrop-workstation/

> If you are an open-source project, a mailing list archive and/or version control repository, with active development:
 
https://github.com/freedomofpress/securedrop/
https://github.com/freedomofpress/securedrop-workstation
 
> Evidence of your status as a user/distributor of Xen:

> Statements about, or descriptions of, your eligible production services or released software, from which it is immediately evident that they use Xen.

The workstation at https://github.com/freedomofpress/securedrop-workstation requires the use of Qubes/Xen.

> Information about your handling of security problems:

> Your invitation to members of the public, who discover security problems with your products/services, to report them in confidence to you;

We invite reports via:

https://github.com/freedomofpress/securedrop-workstation/blob/master/SECURITY.md
https://github.com/freedomofpress/securedrop/blob/develop/SECURITY.md
 
> Specifically, the contact information (email addresses or other contact instructions) which such a member of the public should use.

We receive security reports at: security@freedom.press

We have a public security bug bounty program at: https://bugcrowd.com/freedomofpress

We publish security advisories at: https://securedrop.org/news/security-advisory/

We have read the policy and agree to abide by the terms for inclusion in this list, including the embargo. 

> The single (non-personal) email alias you wish added to the predisclosure list.

security@freedom.press

Please let me know if any additional information is required. 

Best,

Jennifer Helsby

-- 
Jennifer Helsby, Ph.D.
SecureDrop Lead Developer
Freedom of the Press Foundation
<jen@freedom.press>
GnuPG: F48E CC56 4980 83F1 80DF F943 DA05 B7C5 2ABA F334

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
Predisclosure-applications mailing list
Predisclosure-applications@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/predisclosure-applications