Re: Security Questions

[Thomas Schmitt]

Hi,

nelson chidiebube wrote:
> I am working on building an Ubuntu ISO image and will be including some
> confidential files, and would like to know if xorriso passes the security
> compliance test of not leaking information to attackers.

Which security compliance test do you mean in particular ?

In general i can say that xorriso does not send information about its work
to any remote site and does not even record the used xorriso commands or
xorrisofs options in the resulting ISO filesytem.

What you put into the ISO is of course accessible to attackers if they
get access to the ISO and are not stopped from reading by encrypted file
content.
(I am still looking for a stream facility which produces encryption
which can later be put on a block device and decrypted by a /dev/mapper
device.)


Have a nice day :)

Thomas