7 ms·

Citations needed for the personal attacks. For reference, my bug reports to systemd and the ones filed by my coworkers have been handled quickly and professiona

Citations needed for the personal attacks. For reference, my bug reports to systemd and the ones filed by my coworkers have been handled quickly and professionally.

inferiorhuman 8y ago
https://news.ycombinator.com/item?id=14722573 https://news.ycombinator.com/item?id=14722573 https://www.theregister.co.uk/2017/07/28/black_hat_pwnie_awards/ https://www.theregister.co.uk/2017/07/28/black_hat_pwnie_awa... https://github.com/systemd/systemd/issues/5144 https://github.com/systemd/systemd/issues/5144 Hence, I doubt the security community requests what is asked for in this issue. And I am pretty sure it's not our job as developers to file CVEs for any bug – regardless how small – we encounter. CVEs are after all not our currency, but the security community's...
- glennpratt 8y ago
  "Refusing" is a bit strong here. I agree this was a bug, but hardly a remote code exploit. The thread is very level headed and someone else filed the CVE. In the OSS community I run in this is normal, in fact I'd say it's very common for the primary developer to have a differing opinion about severity. But security doesn't depend on one bug ticket or one maintainer. There are many entities and teams at play that check and balance.
  - inferiorhuman 8y ago
    "Refusing" is a bit strong here. How so? In your own words: someone else filed the CVE. Having someone else override Poettering does not mean "Pottering did not refuse". It simply means saner heads prevailed. You don't win a pwnie for high quality code, and the vulns they listed (as well as ones discovered subsequent to the award) all smack of low quality code. As the lead of a core piece of technology I expect more than childish whinging about how "CVEs aren't our currency". You like Pottering, great. I don't, and more to the point I don't like the results of his influence on Linux. When posed the question "why not switch to Linux now?" systemd is high on the list of reasons.
    - glennpratt 8y ago
      I don't "like" Pottering because I don't know the person in the slightest. I have found systemd to be useful software and interactions on the issue queue have been reasonable. I was a happy Upstart user before Upstart threw in the towel too.
  - glennpratt 8y ago
    Also, thanks for the citation. I still strongly feel you've shown something that doesn't warrant a personal attack. As someone who gladly uses systemd while having no particular attachment to it, I find the aggressive and personal attacks confusing.
  - glennpratt 8y ago
    I can't reply at your depth, but Apple and Google also appear to have won a "pwnie", whatever that is. I think think they still do respectable work in spite of it.

Citations needed for the personal attacks. For reference, my bug reports to systemd and the ones filed by my coworkers have been handled quickly and professionally.

inferiorhuman 8y ago

https://news.ycombinator.com/item?id=14722573 https://news.ycombinator.com/item?id=14722573 https://www.theregister.co.uk/2017/07/28/black_hat_pwnie_awards/ https://www.theregister.co.uk/2017/07/28/black_hat_pwnie_awa... https://github.com/systemd/systemd/issues/5144 https://github.com/systemd/systemd/issues/5144 Hence, I doubt the security community requests what is asked for in this issue. And I am pretty sure it's not our job as developers to file CVEs for any bug – regardless how small – we encounter. CVEs are after all not our currency, but the security community's...

glennpratt 8y ago
"Refusing" is a bit strong here. I agree this was a bug, but hardly a remote code exploit. The thread is very level headed and someone else filed the CVE. In the OSS community I run in this is normal, in fact I'd say it's very common for the primary developer to have a differing opinion about severity. But security doesn't depend on one bug ticket or one maintainer. There are many entities and teams at play that check and balance.
- inferiorhuman 8y ago
  "Refusing" is a bit strong here. How so? In your own words: someone else filed the CVE. Having someone else override Poettering does not mean "Pottering did not refuse". It simply means saner heads prevailed. You don't win a pwnie for high quality code, and the vulns they listed (as well as ones discovered subsequent to the award) all smack of low quality code. As the lead of a core piece of technology I expect more than childish whinging about how "CVEs aren't our currency". You like Pottering, great. I don't, and more to the point I don't like the results of his influence on Linux. When posed the question "why not switch to Linux now?" systemd is high on the list of reasons.
  - glennpratt 8y ago
    I don't "like" Pottering because I don't know the person in the slightest. I have found systemd to be useful software and interactions on the issue queue have been reasonable. I was a happy Upstart user before Upstart threw in the towel too.
- glennpratt 8y ago
  Also, thanks for the citation. I still strongly feel you've shown something that doesn't warrant a personal attack. As someone who gladly uses systemd while having no particular attachment to it, I find the aggressive and personal attacks confusing.
- glennpratt 8y ago
  I can't reply at your depth, but Apple and Google also appear to have won a "pwnie", whatever that is. I think think they still do respectable work in spite of it.