Coordinated disclosure

Where to write

[email protected], in French or English.

What makes a report useful: what you observed, when, from which address or node, and how to reproduce it. A packet capture beats a description. If the flaw touches one particular service, name it: several machines and several domains are involved.

There is no public encryption key at this time. If your report must not travel in the clear, say so in one line first and we will agree on a channel.

What interests us

Anything that yields more than intended, or makes the network do what its operators never declared:

• administrative access to a repeater without knowing its password;
• reading a channel without its key;
• a way to have traffic relayed beyond the range an operator declared;
• a flaw in the websites, their admin interfaces or their programming interfaces;
• a data leak: private keys, passwords, positions nobody chose to publish;
• a firmware defect exploitable remotely.

What is not a vulnerability

The band is public and so is the protocol. Properties follow that surprise people, but they are the medium itself, not defects:

• Anyone can listen. A frame travels in the open; any receiver picks it up. Encryption protects a message's content, not the fact that it exists.
• Anyone can transmit, therefore forge. Nothing prevents sending a frame that imitates another. Only identity adverts are signed.
• A region authenticates nobody. Its key derives from a public name: whoever knows the name can tag traffic at that range.
• A sender fingerprint is one byte. One collision in two hundred and fifty-six, and nothing stops anyone copying it. It is not an identity.
• A channel key is shared. Whoever holds it reads the whole channel and can write to it, for as long as it is not rotated.

These points are documented in our pages. We do not treat them as discoveries — but a concrete way to exploit them beyond what they allow by construction does interest us.

Testing without harm

Airtime is shared: every device is allowed a 10 % duty cycle, and what one spends, the others no longer have. A demonstration that saturates the band costs everyone and proves nothing a measured one would not.

• Work on your own devices, or on a bench, rather than on other people's repeaters.
• No denial of service to establish that denial of service is possible: describe it, we will believe you.
• Do not access data that is not yours, and do not keep any. If you come across some, say so and stop there.
• Do not alter or degrade the configuration of a node you do not own.

What we promise, and what we do not

No good-faith report will lead to legal action, provided the rules above were respected.

There is no on-call rota, no guaranteed delay and no reward. Volunteers read this address. A serious report jumps the queue, but if your situation demands an answer within the hour, this is not the right channel. Expect a few days for an acknowledgement.

We do not ask for silence. We ask for a reasonable delay: ninety days is customary, less if the fix ships sooner, more if you agree to wait. If we do not answer, publish: a silent project must not be able to withhold useful information indefinitely.

We gladly credit the author of a report, unless asked otherwise.