5 ms·

Is it now the responsibility of every piece of software to check the versions of every library they're linked to for security patches? Shouldn't that be the res

Is it now the responsibility of every piece of software to check the versions of every library they're linked to for security patches? Shouldn't that be the responsibility of the distribution? edit: is there even a common method for the developer of a library like libebml to flag an update as a security fix to increase the priority of it, or is that up to the package maintainers of each individual distribution to determine? edit2: Or is that common method "file a CVE"?

onli 7y ago
My point is a different one: If a user or a journalist installs the current version of the software and he runs a current distro it is not a surprise that he assumes a (security) flaw that manifests when using that program is caused by the program. The main project does not necessarily have to fix it themselves, but ideally would notify the distro (and that would make for a good response).
- jbk 7y ago
  a journalist is on Windows or mac. They could even chekc that it does not crash with the provided sample.
  - kalleboo 7y ago
    Although in this case, The Register journalist was on Debian, they checked it and it crashed (because Debian packages an old version)
    - rndgermandude 7y ago
      https://www.theregister.co.uk/2019/07/23/remote_code_flaw_vlc/ https://www.theregister.co.uk/2019/07/23/remote_code_flaw_vl... The article writer checked it using an outdated version of VLC (3.0.7 instead of 3.0.7.1), which should have at the very least warranted a closer look into whether the official latest release has the same issue, or if it was a problem with the version packaged by his distro of choice. The "update" The Register did, which really should be a "correction", is half-assed and well hidden below the fold at the end of the article.
- kalleboo 7y ago
  Your post said "notify users about", which is where my comment came from. Notifying distros is something they could do, but how many/which distros do they have to notify? It seems like it could be a massive job in itself. Hence my edit :p
  - onli 7y ago
    Yes, you are definitely correct there. A project can't handle this well all the time. It's too huge a task and too decentralized a system.
tatersolid 7y ago
> Is it now the responsibility of every piece of software to check the versions of every library they're linked to for security patches? Yes, managing dependencies is absolutely the developers’ responsibility. Choosing only well-maintained dependencies is part of that management. > Shouldn't that be the responsibility of the distribution? Not completely. You decided to take that dependency to save yourself effort. The distribution did not make that choice. The distribution may not even have a maintainer anymore. You as the developer need to do what you can ensure the “right” version of your dependency is used. This means talking to packagers and distros, and even (gasp) submitting package updates yourself if you rely on a dependency. Or just bundle local versions of dependencies yourself and stop relying on shared libraries.
- kuschku 7y ago
  > Or just bundle local versions of dependencies yourself and stop relying on shared libraries. That’s what VLC did, Ubuntu/Debian patched VLC to instead use their, older, shared libraries. I’m not sure what course of action you suggest for developers in such a situation
  - tatersolid 7y ago
    > I’m not sure what course of action you suggest for developers in such a situation Talk to somebody at Debian? Or submit a package update for the dependency with a security label?
    - rndgermandude 7y ago
      Let's just waste the limited time the VLC devs can spend (for free) on their project by making them chase after debian maintainers and other distros' maintainers... to get them to update a library that isn't even a VLC project... because debian decided to patch out the library version bundled with VLC in favor of their own outdated libebml package... to get a bug patched that wasn't even considered a security issue until recently... Sorry, but this sounds ridiculous to me.
- cesarb 7y ago

onli 7y ago

My point is a different one: If a user or a journalist installs the current version of the software and he runs a current distro it is not a surprise that he assumes a (security) flaw that manifests when using that program is caused by the program. The main project does not necessarily have to fix it themselves, but ideally would notify the distro (and that would make for a good response).

jbk 7y ago
a journalist is on Windows or mac. They could even chekc that it does not crash with the provided sample.
- kalleboo 7y ago
  Although in this case, The Register journalist was on Debian, they checked it and it crashed (because Debian packages an old version)
  - rndgermandude 7y ago
    https://www.theregister.co.uk/2019/07/23/remote_code_flaw_vlc/ https://www.theregister.co.uk/2019/07/23/remote_code_flaw_vl... The article writer checked it using an outdated version of VLC (3.0.7 instead of 3.0.7.1), which should have at the very least warranted a closer look into whether the official latest release has the same issue, or if it was a problem with the version packaged by his distro of choice. The "update" The Register did, which really should be a "correction", is half-assed and well hidden below the fold at the end of the article.
kalleboo 7y ago
Your post said "notify users about", which is where my comment came from. Notifying distros is something they could do, but how many/which distros do they have to notify? It seems like it could be a massive job in itself. Hence my edit :p
- onli 7y ago
  Yes, you are definitely correct there. A project can't handle this well all the time. It's too huge a task and too decentralized a system.

tatersolid 7y ago

> Is it now the responsibility of every piece of software to check the versions of every library they're linked to for security patches? Yes, managing dependencies is absolutely the developers’ responsibility. Choosing only well-maintained dependencies is part of that management. > Shouldn't that be the responsibility of the distribution? Not completely. You decided to take that dependency to save yourself effort. The distribution did not make that choice. The distribution may not even have a maintainer anymore. You as the developer need to do what you can ensure the “right” version of your dependency is used. This means talking to packagers and distros, and even (gasp) submitting package updates yourself if you rely on a dependency. Or just bundle local versions of dependencies yourself and stop relying on shared libraries.

kuschku 7y ago
> Or just bundle local versions of dependencies yourself and stop relying on shared libraries. That’s what VLC did, Ubuntu/Debian patched VLC to instead use their, older, shared libraries. I’m not sure what course of action you suggest for developers in such a situation
- tatersolid 7y ago
  > I’m not sure what course of action you suggest for developers in such a situation Talk to somebody at Debian? Or submit a package update for the dependency with a security label?
  - rndgermandude 7y ago
    Let's just waste the limited time the VLC devs can spend (for free) on their project by making them chase after debian maintainers and other distros' maintainers... to get them to update a library that isn't even a VLC project... because debian decided to patch out the library version bundled with VLC in favor of their own outdated libebml package... to get a bug patched that wasn't even considered a security issue until recently... Sorry, but this sounds ridiculous to me.
cesarb 7y ago