Gobby stores everthing in a log in ~/.infinote-records
There is no option to delete the log.
The log does not get truncated automatically.
It is not even clear that the log belongs to gobby.
It could reach back for years.
There should be an option for deleting old logs on startup.


Cheers,
  Christoph

tags 605901 +security
thanks

the fact that gobby stores logs in ~/.infinote-records is also
problematic from a security perspective, because most users' default
umask is 022, and the library apparently makes no attempt to make the
logs themselves more hidden.  So the default mode is to leak information
that should be private. :(

i'm glad that gobby is using TLS for network privacy and integrity by
default.  But storing the logs in a world-readable directory nullifies
that effort for users on multi-user systems, or whose home directories
are otherwise world-readable.

By comparison, i believe that other network-aware and privacy-sensitive
tools like firefox or iceweasel make ~/.mozilla mode 0700 by default,
regardless of the user's umask.

Dear submitter,

as the package gobby-infinote has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/792212

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

Control: reopen -1
Control: reassign -1 gobby
Control: tag -1 + upstream

This is still a valid bug report.

Kind regards and thanks
Philipp Kern