5 ms·

No commercial vendor is going to ship bleeding edge code with a promise to support it.

alpb 5y ago
They don't have obligation to ship bleeding edge off-the-shelf code but they do have an obligation to provide the operating system with security patches. If the user clicks on a tar file to extract it and it ends up writing to random places on their filesystem due to a vulnerability, that is gonna be a problem for the enterprise users.
- thrower123 5y ago
  Fortunately Windows won't extract tar files out of the box.
- tinus_hn 5y ago
  Haha as if that doesn’t happen all the time. Enterprise says ‘well nothing is truly secure’ and just installs the update after a month.
Wowfunhappy 5y ago
They should patch whatever vulnerabilities exist in whatever version of the component they've decided to ship. That's the point of it being open source.
- stusmall 5y ago
  From the post I'm not positive that they aren't. The release date and patch date in that version string are different. They might be cherry picking individual patches back to an out of tree branch and haven't had anything since 11-19 that met their threshold for cherry picking. I'd be interested in which have these 15 CVEs are actually exploitable and their CVSS are before I jump to conclusions from just a version string.
- jodrellblank 5y ago
  The point of it being open source is that you can demand the person who gave it to you should fix it to your specifications for free? I don't see that mentioned in The Four Freedoms of Open Source: https://yairudi.com/foss-principles-explained-ch-ii-open-sources-four-freedoms/ https://yairudi.com/foss-principles-explained-ch-ii-open-sou...
  - Wowfunhappy 5y ago
    I'm speaking from the point of view of Microsoft as a user of open source software. Microsoft is not the end-user, but they are taking open source code and using it within their own product, Windows. Microsoft has the freedom to modify the OSS components in Windows to patch security vulnerabilities.
  - rini17 5y ago
    Your copy of MS Windows is free? And by what logic open source parts of it are exempt from any expectations of support?
nix23 5y ago
>No commercial vendor is going to ship bleeding edge code with a promise to support it. Netflix Open Connect ;)

alpb 5y ago

They don't have obligation to ship bleeding edge off-the-shelf code but they do have an obligation to provide the operating system with security patches. If the user clicks on a tar file to extract it and it ends up writing to random places on their filesystem due to a vulnerability, that is gonna be a problem for the enterprise users.

thrower123 5y ago
Fortunately Windows won't extract tar files out of the box.
tinus_hn 5y ago
Haha as if that doesn’t happen all the time. Enterprise says ‘well nothing is truly secure’ and just installs the update after a month.

Wowfunhappy 5y ago

They should patch whatever vulnerabilities exist in whatever version of the component they've decided to ship. That's the point of it being open source.

stusmall 5y ago
From the post I'm not positive that they aren't. The release date and patch date in that version string are different. They might be cherry picking individual patches back to an out of tree branch and haven't had anything since 11-19 that met their threshold for cherry picking. I'd be interested in which have these 15 CVEs are actually exploitable and their CVSS are before I jump to conclusions from just a version string.
jodrellblank 5y ago
The point of it being open source is that you can demand the person who gave it to you should fix it to your specifications for free? I don't see that mentioned in The Four Freedoms of Open Source: https://yairudi.com/foss-principles-explained-ch-ii-open-sources-four-freedoms/ https://yairudi.com/foss-principles-explained-ch-ii-open-sou...
- Wowfunhappy 5y ago
  I'm speaking from the point of view of Microsoft as a user of open source software. Microsoft is not the end-user, but they are taking open source code and using it within their own product, Windows. Microsoft has the freedom to modify the OSS components in Windows to patch security vulnerabilities.
- rini17 5y ago
  Your copy of MS Windows is free? And by what logic open source parts of it are exempt from any expectations of support?

nix23 5y ago

>No commercial vendor is going to ship bleeding edge code with a promise to support it. Netflix Open Connect ;)