3 ms·

The response seems … snippy: Am I missing something? It does appear from the link you provided that the maintainers regressed back across the last three major

by dvtrn 7y ago

The response seems … snippy: Am I missing something? It does appear from the link you provided that the maintainers regressed back across the last three major releases and also couldn't reproduce the issue, and I suspect their snippiness is coming from Gizmodo's[1] haste to publish an article asserting that their product contained vulnerabilities when it so far cannot be proved to.Possibly even the assertion that "VideoLAN is also aware of the issue and is currently working on a patch, though right now" which has me wondering: Did anyone at Gizmodo actually read the issue tracker to see the testing done by JBK? I'd be a bit annoyed and prone to snippiness at this kind of reporting about my code in a major online publication as well, honestly. --- [1] https://gizmodo.com/you-might-want-to-uninstall-vlc-immediately-1836641101?fbclid=IwAR0ekZB3YuSBYezsxSvd1UjKEoU_8zvqRdxCipxms4f5ayWMJTyR1GtzeLk https://gizmodo.com/you-might-want-to-uninstall-vlc-immediat...

deathanatos 7y ago
That's fair; the article is probably taking its information from the CVE and the links to Symantec's "Security Focus" where apparently the research claims to have prepared an exploit. The bug itself (which perhaps is all the VLC people are looking at, aside from the news, now?) is pretty bare bones. I too have no idea where Gizmodo is getting the notion that it is being worked on. Perhaps they're getting that from the failed reproduction attempts.
- dvtrn 7y ago
  Judging from the statement: VideoLAN is also aware of the issue and is currently working on a patch, though right now I'm going to guess someone quickly glanced at the issue tracker, saw a percentage of work done and presumed "vulnerability: valid" and pressed on with publication without bothering to try reaching JBK for comment. Both sites really ought to update their posts for clarity. Terrible form, IMO --in the interest of security disclosures. VideoLAN does not seem amused about it either: https://twitter.com/videolan/status/1153715138333220864 https://twitter.com/videolan/status/1153715138333220864
- av3csr 7y ago
  They probably read the third comment, Component: Demuxers → Demuxers: MKV Work status: 60% → Not started

by dvtrn 7y ago

deathanatos 7y ago

That's fair; the article is probably taking its information from the CVE and the links to Symantec's "Security Focus" where apparently the research claims to have prepared an exploit. The bug itself (which perhaps is all the VLC people are looking at, aside from the news, now?) is pretty bare bones. I too have no idea where Gizmodo is getting the notion that it is being worked on. Perhaps they're getting that from the failed reproduction attempts.

dvtrn 7y ago
Judging from the statement: VideoLAN is also aware of the issue and is currently working on a patch, though right now I'm going to guess someone quickly glanced at the issue tracker, saw a percentage of work done and presumed "vulnerability: valid" and pressed on with publication without bothering to try reaching JBK for comment. Both sites really ought to update their posts for clarity. Terrible form, IMO --in the interest of security disclosures. VideoLAN does not seem amused about it either: https://twitter.com/videolan/status/1153715138333220864 https://twitter.com/videolan/status/1153715138333220864
av3csr 7y ago
They probably read the third comment, Component: Demuxers → Demuxers: MKV Work status: 60% → Not started