TechnologySecurity
Kapaso puts reporting address, checksums and update commitments on one page
kapaso.de/sicherheit states where to report security flaws and until when Kapaso commits to security updates for each version.
Kapaso solution: What this article describes is made by the publisher of this magazine.
Kapaso GmbH has brought the security information for its products together on one page: kapaso.de/sicherheit.
Anyone who finds a security flaw writes to the address given there. The company undertakes to confirm receipt within three working days and to respond with a first assessment within ten. The same details are available in machine-readable form as security.txt, including at the addresses of the services it operates.
A table lists, for each product, the version, the EU declaration of conformity and the date until which security updates are promised. It covers the AIO Hub management software, the Android and Windows players, the LivePlay AirPlay receiver and the kiosk of the KAS Control queue system. The dates fall in 2031. Kapaso commits to security updates and delivers them through the current version of each product.
The current installation files each have a SHA-256 checksum on the page, along with the commands for recalculating it on Windows, macOS and Linux. No security advisories are currently published there. When one appears, it is to state an identifier, the affected and fixed versions, the severity and the remedy; according to the company, security updates show up in AIO Hub as an urgent notice.
Three products that Kapaso runs exclusively as a service are listed separately. The same reporting address applies to them.
