4 ms·
My point is a different one: If a user or a journalist installs the current version of the software and he runs a current distro it is not a surprise that he as
by onli 7y ago
My point is a different one: If a user or a journalist installs the current version of the software and he runs a current distro it is not a surprise that he assumes a (security) flaw that manifests when using that program is caused by the program. The main project does not necessarily have to fix it themselves, but ideally would notify the distro (and that would make for a good response).
- jbk 7y agoa journalist is on Windows or mac. They could even chekc that it does not crash with the provided sample.
- kalleboo 7y agoAlthough in this case, The Register journalist was on Debian, they checked it and it crashed (because Debian packages an old version)
- rndgermandude 7y agohttps://www.theregister.co.uk/2019/07/23/remote_code_flaw_vlc/ https://www.theregister.co.uk/2019/07/23/remote_code_flaw_vl... The article writer checked it using an outdated version of VLC (3.0.7 instead of 3.0.7.1), which should have at the very least warranted a closer look into whether the official latest release has the same issue, or if it was a problem with the version packaged by his distro of choice. The "update" The Register did, which really should be a "correction", is half-assed and well hidden below the fold at the end of the article.
- kalleboo 7y agoYour post said "notify users about", which is where my comment came from. Notifying distros is something they could do, but how many/which distros do they have to notify? It seems like it could be a massive job in itself. Hence my edit :p
- onli 7y agoYes, you are definitely correct there. A project can't handle this well all the time. It's too huge a task and too decentralized a system.