3 ms·

> Around three months ago, a post was published (mirror) on GitHub's Gist service. In the report, multiple vulnerabilities against portsnap, freebsd-update, bsp

> Around three months ago, a post was published (mirror) on GitHub's Gist service. In the report, multiple vulnerabilities against portsnap, freebsd-update, bspatch, and libarchive were detailed. To this date, FreeBSD has been silent on official mailing lists. Why didn't the poster file the bugs in the FreeBSD bug tracker and/or contact the FreeBSD security team? Even posting to the mailing list would have been better than posting on some random github page. I don't think you can fault the FreeBSD people for not seeing some random post online.

SFJulie 10y ago
Have you tried using some of the bug trackers in FOSS? Debian, python, mozilla, freeBSD are both quite a pain to use and most of all, you lose track of thee global picture. Especially when core devs have a tendency to either let the bugs opened or close them for no reasons. The unsane default of freeBSD are quite known. Having a list of them give the picture. I actually run FreeBSD to escape systemd insanity. BSD communities are far smaller than linux one, it is also a little bit «secretive» (compared to all the docs and books) on how to build drivers. Since the linux ecosystem is having all the «heavy weight» desktop applications and that freeBSD has invested quite a lot in linux compatibility I fear they lack resources to do everything. But, remember that ubuntu is providing LTS distributions with an amazing number of very used non patched packages. The state of security in linux/windows/mac OSX/BSD is a direct consequence of the multiplication of bloatware package that are poorly maintained and sometimes coded. There will be a time for cleaning.
- ashitlerferad 10y ago
  Submitting a Debian bug needs a single email with one required header line, hardly a pain to use.
  - jlgaddis 10y ago
    FreeBSD uses Bugzilla, which is a bit more work than that, but certainly nothing beyond the grasp of anyone on HN.
    - talideon 10y ago
      ...and significantly easier than the old GNATS-based system that preceded it. There have been active efforts within the project to make this sort of thing much easier for newcomers than it used to be.
- JdeBP 10y ago
  > Have you tried using some of the bug trackers in FOSS? As a matter of fact, I have, thank you for asking. * https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205776 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205776 * https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205777 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205777 * https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205778 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205778 * https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205786 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205786 * https://bugs.freenas.org/issues/12986 https://bugs.freenas.org/issues/12986 * https://bugs.freenas.org/issues/12987 https://bugs.freenas.org/issues/12987 * https://bugs.freenas.org/issues/12988 https://bugs.freenas.org/issues/12988
voltagex_ 10y ago
More info and theories: https://github.com/libarchive/libarchive/issues/743 https://github.com/libarchive/libarchive/issues/743 It did also make at least one FreeBSD list - https://lists.freebsd.org/pipermail/freebsd-security/2016-July/009016.html https://lists.freebsd.org/pipermail/freebsd-security/2016-Ju... with the appropriately terse followup https://lists.freebsd.org/pipermail/freebsd-security/2016-July/009017.html https://lists.freebsd.org/pipermail/freebsd-security/2016-Ju...
rurban 10y ago
I added the 2 HardenedBSD fixes to the libarchive issues at least.

SFJulie 10y ago

Have you tried using some of the bug trackers in FOSS? Debian, python, mozilla, freeBSD are both quite a pain to use and most of all, you lose track of thee global picture. Especially when core devs have a tendency to either let the bugs opened or close them for no reasons. The unsane default of freeBSD are quite known. Having a list of them give the picture. I actually run FreeBSD to escape systemd insanity. BSD communities are far smaller than linux one, it is also a little bit «secretive» (compared to all the docs and books) on how to build drivers. Since the linux ecosystem is having all the «heavy weight» desktop applications and that freeBSD has invested quite a lot in linux compatibility I fear they lack resources to do everything. But, remember that ubuntu is providing LTS distributions with an amazing number of very used non patched packages. The state of security in linux/windows/mac OSX/BSD is a direct consequence of the multiplication of bloatware package that are poorly maintained and sometimes coded. There will be a time for cleaning.

ashitlerferad 10y ago
Submitting a Debian bug needs a single email with one required header line, hardly a pain to use.
- jlgaddis 10y ago
  FreeBSD uses Bugzilla, which is a bit more work than that, but certainly nothing beyond the grasp of anyone on HN.
  - talideon 10y ago
    ...and significantly easier than the old GNATS-based system that preceded it. There have been active efforts within the project to make this sort of thing much easier for newcomers than it used to be.
JdeBP 10y ago
> Have you tried using some of the bug trackers in FOSS? As a matter of fact, I have, thank you for asking. * https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205776 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205776 * https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205777 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205777 * https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205778 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205778 * https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205786 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=205786 * https://bugs.freenas.org/issues/12986 https://bugs.freenas.org/issues/12986 * https://bugs.freenas.org/issues/12987 https://bugs.freenas.org/issues/12987 * https://bugs.freenas.org/issues/12988 https://bugs.freenas.org/issues/12988

voltagex_ 10y ago

More info and theories: https://github.com/libarchive/libarchive/issues/743 https://github.com/libarchive/libarchive/issues/743 It did also make at least one FreeBSD list - https://lists.freebsd.org/pipermail/freebsd-security/2016-July/009016.html https://lists.freebsd.org/pipermail/freebsd-security/2016-Ju... with the appropriately terse followup https://lists.freebsd.org/pipermail/freebsd-security/2016-July/009017.html https://lists.freebsd.org/pipermail/freebsd-security/2016-Ju...

rurban 10y ago

I added the 2 HardenedBSD fixes to the libarchive issues at least.