X-Git-Url: http://git.freeside.biz/gitweb/?a=blobdiff_plain;f=rt%2Fdocs%2Fsecurity.pod;h=7120e389a7f32c63451ce1ac165ec36db77c3f7f;hb=f73a37bd1dfd6f8e5cd497b8ac2843a7b8b1247b;hp=620f8687c61f416ab8c1dc5c4c9abd000abbdebd;hpb=c24d6e2242ae0e026684b8f95decf156aba6e75e;p=freeside.git diff --git a/rt/docs/security.pod b/rt/docs/security.pod index 620f8687c..7120e389a 100644 --- a/rt/docs/security.pod +++ b/rt/docs/security.pod @@ -16,8 +16,8 @@ After a security vulnerability is reported to Best Practical and verified, we attempt to resolve it in as timely a fashion as possible. Best Practical support customers will be notified before we disclose the information to the public. All security announcements will be sent to -C, which includes -C and C. +C and posted to the community forum at +L As the tests for security vulnerabilities are often nearly identical to working exploits, sensitive tests will be embargoed for a period of six @@ -32,11 +32,7 @@ months before being added to the public RT repository. Protect your RT installation by making it only accessible via SSL. This will protect against users' passwords being sniffed as they go over the -wire, as well as helping prevent phishing attacks. If you use SSL, you -will need to install some additional Perl libraries so that C -can connect. You can use the C<--enable-ssl-mailgate> command to -configure to automate the installation of these dependencies. This is -documented further in step 10 of the README. +wire, as well as helping prevent phishing attacks. You should use a certificate signed by a reputable authority, or at very least a certificate signed by a consistent local CA, which you configure