5 ms·

So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online

by LeonM 7y ago

So none of the tech news websites contacted VideoLAN and published their articles without checking their source. I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago.

Maxious 7y ago
https://news.softpedia.com/news/critical-flaw-in-vlc-media-player-discovered-by-german-cybersecurity-agency-526768.shtml https://news.softpedia.com/news/critical-flaw-in-vlc-media-p... sources https://winfuture.de/news,110171.html https://winfuture.de/news,110171.html sources https://www.cert-bund.de/advisoryshort/CB-K19-0634 https://www.cert-bund.de/advisoryshort/CB-K19-0634 sources https://nvd.nist.gov/vuln/detail/CVE-2019-13615 https://nvd.nist.gov/vuln/detail/CVE-2019-13615 which finally gets to the bug report https://trac.videolan.org/vlc/ticket/22474 https://trac.videolan.org/vlc/ticket/22474 To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it
- jbk 7y ago
  > To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it Of course, we never reported such a thing: a security issue in a 3rd party library, fixed more than 16months ago. And VLC binaries were updated 16months ago too... The issue is that MITRE is not doing its job when assigning the CVE or even checking the validity of the claim. But they refuse to talk to us. Why?
  - dsfyu404ed 7y ago
    >But they refuse to talk to us. Why? Because stonewalling is SOP for government bureaucracies when they screw up. When you're the government the various systems the people you screwed have for recourse work slightly differently so stonewalling works better than spewing out a ton of deny and distract PR like corporations do.
    - majewsky 7y ago
      > Because stonewalling is SOP for big orgs when they screw up. FTFY A lot of people seem to be under the impression that when you just privatize a government agency, it magically becomes better. It doesn't.
- tastroder 7y ago
  I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. Even on vulnerable systems this seems to have been a local issue (or do they do that for anything that might potentially pull malicious files from outside sources? Sounds kind of backwards.)
  - jbk 7y ago
    > I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. They always do that with VLC: even file can be on a playlist, and a playlist can be sent by email or over the web, with a link... So they classify all VLC bugs with network and remote.
    - virgilp 7y ago
      By that token, is there ANY application where the attack vector is not 'network' and 'remote' is 'no'? Because I fail to think of any minimally-useful app that doesn't open external files.
      - jbk 7y ago
        Because we support playlists. I know it does make sense, but Mitre is never answering.
      - throwaway_391 7y ago
        CVSS is an insane rating system made for a simpler time by antiquated practices which doesn't account for many factors either well if at all. Hover your mouse over each button https://www.first.org/cvss/calculator/3.0 https://www.first.org/cvss/calculator/3.0 . There's Attack complexity 'low' and 'high', for instance. You're either a script kiddie or have a two billion dollar exploitation budget and all the human resources you need, but nothing in between.
        wademealing 7y ago
        I will wear my vendor hat here for a moment, AC not about the attacker, but the configuration of the component being assessed.
larrysalibra 7y ago
News articles not checking sources is pretty standard. A few years ago I had a blog post about something regarding Apple picked up by the Hong Kong Free Press and then the New York Times. It ended up resulting in articles across hundreds of publications. The only publications that talked to me and Apple were the New York Times, the original Hong Kong Free Press and a CNN money reporter. Everyone else was just rewriting other posts. The economics of the industry drive this behavior - most reporters have a quota of stories they have to write per day and there's no time or budget to even email sources let alone sit around waiting for a reply. If you want to read more about this, I recommend the book "Trust me, I'm lying" by Ryan Holiday.
- nemosaltat 7y ago
  Excellent book. I particularly like his thoughts on the “link economy”- how links give credence to statements in an article despite the fact that they may not even link to a relevant or accurate source. That said, I “read” a lot of of audiobooks and this one is self-narrated. I highly recommend the book, but don’t recommend Ryan Holiday as a narrator.
  - fernandotakai 7y ago
    i've found that trust me i'm lying was horribly recorded (at least on audible) --i tried listening to it twice, and just couldn't. i also tried listening to conspiracy, also by him, and it was much more enjoyable (he narrates, but the sound quality is much better).
npiht 7y ago
I expect a little bit of personal responsibility at this point. You simply should not believe what you read in the news. It's either not researched at all or just false.
jbk 7y ago
> So none of the tech news websites contacted VideoLAN and published their articles without checking their source. Actually, one did: numerama. That's all. > I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago. My night and morning have been difficult, as you can imagine...
- JosephRedfern 7y ago
  I'm sorry that you're having a bad couple of days thanks to shitty journalism. Thank you for your efforts in developing VLC, it is a great tool.
- wademealing 7y ago
  I wrote to NIST/NVD tis morning about the CVSS score (12+ hours ago now) they haven't got back to me.
- madez 7y ago
  Thank you for your contributions on VLC. It shines bad light on the official institutions that they haven't checked back with you.
- simonebrunozzi 7y ago
  It will sound boring quickly, but I also want to thank you for developing VLC. Great work. Amazing work. You have many devoted fans all around the world.
- chachachoney 7y ago
  Off topic, but... I've used VLC on all supported platforms for almost as long as it's been in existence: THANK YOU.
- BasicObject 7y ago
  I wanted to thank you for your work on VLC as well. It has been my go to video player for many years.
- meowface 7y ago
  We all love VLC and know the hard work you put into it, and into keeping it secure. Don't stress too much. The media buzz will die down soon.
Zenst 7y ago
If VLC was a commercial product, this would be a lawyer time for effectively damaging reputation based upon lies and would see many media outlet dragged over the coals. VLC is not a commercial product, but equally still took the same impact from this and as we know, many end-user will be oblivious of any retraction as the case with many media retractions/corrections that get buried and do not traction. Maybe we need Open Lawyer as well as Open Source! I'm of the thinking that the only way media would get any education would be litigation. Sad I know, but that is the World they operate in. Why else do media outlets have lawyer departments.
- pbhjpbhj 7y ago
  [Edit, see below.]
  - jbk 7y ago
    VLC is open source, distributed by VideoLAN non-profit and is totally non-commercial. The only money received by the non-profit is through donations.
    - pbhjpbhj 7y ago
      I didn't express that well: In copyright terms, if you compete with commercial; or acquire money via a side-channel then it's "commercial" ... what I was trying to express was that it occupies a space where it's serious software and that damage to it's reputation should be treated just as seriously as damage to a sold product from a for-profit. Apologies.
    - Zenst 7y ago
      Yes, hence they don't have a lawyer ontap, which was kinda the point I was making. The education (what I'm going to call it) that they could bestow upon these bismershing media outlets, would fund much Open Source work for VLC.
      - dvtrn 7y ago
        You say “they don’t have a lawyer” I don’t know if you realize you’re addressing the lead developer and president of VLC. I think he may be quite a bit more aware of his org’s ability and desire to retain legal counsel than all of us.
lucideer 7y ago
This is worse though. Neither MITRECorp, CERT-Bund.de nor NIST are tech news websites or journalistic publications. This is beyond being an issue with online news: this is an issue with security organisations actively ignoring their own policies due—seemingly—to an institutional disregard for a non-commercial FOSS project.
rkagerer 7y ago
Suggest everyone here pick a couple of news agencies who propagated this crap and write to the editors admonishing their shoddy fact-checking. I emailed two this morning.
nvr219 7y ago
> I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. This problem has been around as long as more than one news outlet has been around... Getting the story first over getting the story right didn't get invented by online news.

by LeonM 7y ago

Maxious 7y ago

https://news.softpedia.com/news/critical-flaw-in-vlc-media-player-discovered-by-german-cybersecurity-agency-526768.shtml https://news.softpedia.com/news/critical-flaw-in-vlc-media-p... sources https://winfuture.de/news,110171.html https://winfuture.de/news,110171.html sources https://www.cert-bund.de/advisoryshort/CB-K19-0634 https://www.cert-bund.de/advisoryshort/CB-K19-0634 sources https://nvd.nist.gov/vuln/detail/CVE-2019-13615 https://nvd.nist.gov/vuln/detail/CVE-2019-13615 which finally gets to the bug report https://trac.videolan.org/vlc/ticket/22474 https://trac.videolan.org/vlc/ticket/22474 To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it

jbk 7y ago
> To boot https://www.securityfocus.com/bid/109304 https://www.securityfocus.com/bid/109304 claims all versions are vulnerable and the vendor reported it Of course, we never reported such a thing: a security issue in a 3rd party library, fixed more than 16months ago. And VLC binaries were updated 16months ago too... The issue is that MITRE is not doing its job when assigning the CVE or even checking the validity of the claim. But they refuse to talk to us. Why?
- dsfyu404ed 7y ago
  >But they refuse to talk to us. Why? Because stonewalling is SOP for government bureaucracies when they screw up. When you're the government the various systems the people you screwed have for recourse work slightly differently so stonewalling works better than spewing out a ton of deny and distract PR like corporations do.
  - majewsky 7y ago
    > Because stonewalling is SOP for big orgs when they screw up. FTFY A lot of people seem to be under the impression that when you just privatize a government agency, it magically becomes better. It doesn't.
tastroder 7y ago
I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. Even on vulnerable systems this seems to have been a local issue (or do they do that for anything that might potentially pull malicious files from outside sources? Sounds kind of backwards.)
- jbk 7y ago
  > I really wonder where the CVE got their "attack vector: network" and CERT "remote: yes" classifications from. They always do that with VLC: even file can be on a playlist, and a playlist can be sent by email or over the web, with a link... So they classify all VLC bugs with network and remote.
  - virgilp 7y ago
    By that token, is there ANY application where the attack vector is not 'network' and 'remote' is 'no'? Because I fail to think of any minimally-useful app that doesn't open external files.
    - jbk 7y ago
      Because we support playlists. I know it does make sense, but Mitre is never answering.
    - throwaway_391 7y ago
      CVSS is an insane rating system made for a simpler time by antiquated practices which doesn't account for many factors either well if at all. Hover your mouse over each button https://www.first.org/cvss/calculator/3.0 https://www.first.org/cvss/calculator/3.0 . There's Attack complexity 'low' and 'high', for instance. You're either a script kiddie or have a two billion dollar exploitation budget and all the human resources you need, but nothing in between.
      - wademealing 7y ago
        I will wear my vendor hat here for a moment, AC not about the attacker, but the configuration of the component being assessed.

larrysalibra 7y ago

News articles not checking sources is pretty standard. A few years ago I had a blog post about something regarding Apple picked up by the Hong Kong Free Press and then the New York Times. It ended up resulting in articles across hundreds of publications. The only publications that talked to me and Apple were the New York Times, the original Hong Kong Free Press and a CNN money reporter. Everyone else was just rewriting other posts. The economics of the industry drive this behavior - most reporters have a quota of stories they have to write per day and there's no time or budget to even email sources let alone sit around waiting for a reply. If you want to read more about this, I recommend the book "Trust me, I'm lying" by Ryan Holiday.

nemosaltat 7y ago
Excellent book. I particularly like his thoughts on the “link economy”- how links give credence to statements in an article despite the fact that they may not even link to a relevant or accurate source. That said, I “read” a lot of of audiobooks and this one is self-narrated. I highly recommend the book, but don’t recommend Ryan Holiday as a narrator.
- fernandotakai 7y ago
  i've found that trust me i'm lying was horribly recorded (at least on audible) --i tried listening to it twice, and just couldn't. i also tried listening to conspiracy, also by him, and it was much more enjoyable (he narrates, but the sound quality is much better).

npiht 7y ago

I expect a little bit of personal responsibility at this point. You simply should not believe what you read in the news. It's either not researched at all or just false.

jbk 7y ago

> So none of the tech news websites contacted VideoLAN and published their articles without checking their source. Actually, one did: numerama. That's all. > I feel bad for VideoLAN, according to them the bug was in a 3rd party lib and was fixed 16 months ago. My night and morning have been difficult, as you can imagine...

JosephRedfern 7y ago
I'm sorry that you're having a bad couple of days thanks to shitty journalism. Thank you for your efforts in developing VLC, it is a great tool.
wademealing 7y ago
I wrote to NIST/NVD tis morning about the CVSS score (12+ hours ago now) they haven't got back to me.
madez 7y ago
Thank you for your contributions on VLC. It shines bad light on the official institutions that they haven't checked back with you.
simonebrunozzi 7y ago
It will sound boring quickly, but I also want to thank you for developing VLC. Great work. Amazing work. You have many devoted fans all around the world.
chachachoney 7y ago
Off topic, but... I've used VLC on all supported platforms for almost as long as it's been in existence: THANK YOU.
BasicObject 7y ago
I wanted to thank you for your work on VLC as well. It has been my go to video player for many years.
meowface 7y ago
We all love VLC and know the hard work you put into it, and into keeping it secure. Don't stress too much. The media buzz will die down soon.

Zenst 7y ago

If VLC was a commercial product, this would be a lawyer time for effectively damaging reputation based upon lies and would see many media outlet dragged over the coals. VLC is not a commercial product, but equally still took the same impact from this and as we know, many end-user will be oblivious of any retraction as the case with many media retractions/corrections that get buried and do not traction. Maybe we need Open Lawyer as well as Open Source! I'm of the thinking that the only way media would get any education would be litigation. Sad I know, but that is the World they operate in. Why else do media outlets have lawyer departments.

pbhjpbhj 7y ago
[Edit, see below.]
- jbk 7y ago
  VLC is open source, distributed by VideoLAN non-profit and is totally non-commercial. The only money received by the non-profit is through donations.
  - pbhjpbhj 7y ago
    I didn't express that well: In copyright terms, if you compete with commercial; or acquire money via a side-channel then it's "commercial" ... what I was trying to express was that it occupies a space where it's serious software and that damage to it's reputation should be treated just as seriously as damage to a sold product from a for-profit. Apologies.
  - Zenst 7y ago
    Yes, hence they don't have a lawyer ontap, which was kinda the point I was making. The education (what I'm going to call it) that they could bestow upon these bismershing media outlets, would fund much Open Source work for VLC.
    - dvtrn 7y ago
      You say “they don’t have a lawyer” I don’t know if you realize you’re addressing the lead developer and president of VLC. I think he may be quite a bit more aware of his org’s ability and desire to retain legal counsel than all of us.

lucideer 7y ago

This is worse though. Neither MITRECorp, CERT-Bund.de nor NIST are tech news websites or journalistic publications. This is beyond being an issue with online news: this is an issue with security organisations actively ignoring their own policies due—seemingly—to an institutional disregard for a non-commercial FOSS project.

rkagerer 7y ago

Suggest everyone here pick a couple of news agencies who propagated this crap and write to the editors admonishing their shoddy fact-checking. I emailed two this morning.

nvr219 7y ago

> I believe this sums up the problem with online news: being first matters most to news sites. It drives traffic. Accurate reporting comes second. This problem has been around as long as more than one news outlet has been around... Getting the story first over getting the story right didn't get invented by online news.