4 ms·

The author here just blindly assumes a lot of things about VirtualBox's bug bounty program. Many, like Google, put a very strict limit, and they will release th

The author here just blindly assumes a lot of things about VirtualBox's bug bounty program. Many, like Google, put a very strict limit, and they will release the details when that time is over. I think it's more respectful to at least give them a chance, rather than throwing a hot shit on their lap and making hundreds of people's life a living hell for a week. The engineers in charge quickly patching this up aren't the ones who came up with the bounty program. Making them pay for it seems like a pretty shitty move.

exikyut 8y ago
OK, so a bunch of engineers have been told to drop everything to patch this. Maybe work weekends, (hopefully not) provide hourly updates on their work, etc. I don't see fixing this as entirely tricky; the patch looks to be a few lines of code. Then it's over to testing for a short run, and the release team will be running around informing vendors in order of importance and then updating https://www.virtualbox.org/wiki/Changelog https://www.virtualbox.org/wiki/Changelog, which incidentally hasn't changed yet (it will be interesting to see when this happens / how long it takes). So that's the on-the-ground mess that's been made. It's annoying, but not the end of the world, so concentrating only on the lowest level is arguably a distraction from the bigger picture - which is impacted by all such events as this.
bdhess 8y ago
> rather than throwing a hot shit on their lap Well really, Oracle threw the hot shit in customers’ laps. The author just had the gall to point it out. > making hundreds of people's life a living hell for a week > Making them pay for it seems like a pretty shitty move. It sounds like you assume Oracle is going to abuse its staff in the process of getting this fixed. I don’t know why you assume that, nor why the author ought to be blamed if Oracle does.
- deleted 8y ago
  [deleted]
- ehsankia 8y ago
  > Oracle threw the hot shit Right, Oracle as an organization did, not necessarily the engineers who will be tasked with fixing this. > Oracle is going to abuse its staff Not necessarily abuse, but obviously, having 30 days to fix something is a much more saner experience than when every minute counts.
iforgotpassword 8y ago
Blindly assuming? https://blogs.securiteam.com/index.php/archives/3736 https://blogs.securiteam.com/index.php/archives/3736 Sounds pretty first hand to me.
- oarsinsync 8y ago
  Specifically: > While the crashing bug was reported to the VirtualBox tracker (https://www.virtualbox.org/ticket/16444 https://www.virtualbox.org/ticket/16444), it was never considered a security vulnerability, and is not marked as one. This ticket is 15 months old at the time of writing this post and still marked as unresolved.
drivebywanker 8y ago
What exactly did they do to earn our respect? Shit out software I'd have been ashamed of when I was 16? Sell us to advertisers? Build walled gardens to keep us locked in?

exikyut 8y ago

OK, so a bunch of engineers have been told to drop everything to patch this. Maybe work weekends, (hopefully not) provide hourly updates on their work, etc. I don't see fixing this as entirely tricky; the patch looks to be a few lines of code. Then it's over to testing for a short run, and the release team will be running around informing vendors in order of importance and then updating https://www.virtualbox.org/wiki/Changelog https://www.virtualbox.org/wiki/Changelog, which incidentally hasn't changed yet (it will be interesting to see when this happens / how long it takes). So that's the on-the-ground mess that's been made. It's annoying, but not the end of the world, so concentrating only on the lowest level is arguably a distraction from the bigger picture - which is impacted by all such events as this.

bdhess 8y ago

> rather than throwing a hot shit on their lap Well really, Oracle threw the hot shit in customers’ laps. The author just had the gall to point it out. > making hundreds of people's life a living hell for a week > Making them pay for it seems like a pretty shitty move. It sounds like you assume Oracle is going to abuse its staff in the process of getting this fixed. I don’t know why you assume that, nor why the author ought to be blamed if Oracle does.

deleted 8y ago
[deleted]
ehsankia 8y ago
> Oracle threw the hot shit Right, Oracle as an organization did, not necessarily the engineers who will be tasked with fixing this. > Oracle is going to abuse its staff Not necessarily abuse, but obviously, having 30 days to fix something is a much more saner experience than when every minute counts.

iforgotpassword 8y ago

Blindly assuming? https://blogs.securiteam.com/index.php/archives/3736 https://blogs.securiteam.com/index.php/archives/3736 Sounds pretty first hand to me.

oarsinsync 8y ago
Specifically: > While the crashing bug was reported to the VirtualBox tracker (https://www.virtualbox.org/ticket/16444 https://www.virtualbox.org/ticket/16444), it was never considered a security vulnerability, and is not marked as one. This ticket is 15 months old at the time of writing this post and still marked as unresolved.

drivebywanker 8y ago

What exactly did they do to earn our respect? Shit out software I'd have been ashamed of when I was 16? Sell us to advertisers? Build walled gardens to keep us locked in?