[Galene] Galene security review

[Juliusz Chroboczek <jch@irif.fr>]

Hi,

Back in January, Galene underwent a security review by Sven Vink of
Radically Open Security, funded by NLnet.  It was very interesting, we had
some very interesting chats with the reviewer, and I learned a lot.

The document is here:

  https://galene.org/NGICore%20Galene%20penetration%20test%20report%202025%201.0.pdf

The summary is on page 5:

> During this crystal-box penetration test we found 7 Moderate and
> 5 Low-severity issues.

The bad news are the path traversal issues; as a mitigating factor,
they're only exposed to privileged users (you need to have the "record"
permissions).  They have been fixed in Galene back in January.

Most issues found by the review were fixed in Galene 0.96.2.  Exceptions:

  * password policy: Galene accepts weak passwords by design: I find it
    convenient to organise meetings with a password that can easily be
    dictated on the phone, especially when the meetings are not confidential;

  * HSTS (security headers): this complicates administration, and is
    therefore at odds with the goals of Galene;

  * protection against brute force attacks and disk space exhaustion;

  * insufficient logging.

Thanks to Sven Vink for his work and the interesting chats, and to NLnet
for funding the review.

-- Juliusz