3 ms·
> This was not caught by Dell, or even the STH team at first, it was a YouTube commenter. If that is how we as an industry are catching the easy plain-to-see st
by ohazi 5y ago
> This was not caught by Dell, or even the STH team at first, it was a YouTube commenter. If that is how we as an industry are catching the easy plain-to-see stuff, that should scare everyone about what may be hard to see.
And this is why the people shouting that "the direct cause of the log4j bug is our collective failure to give open source maintainers bags of money" are wrong. Don't get me wrong, you should give people bags of money if you want them to drop everything and go fix a critical bug after it's been discovered.
But our collective ability to discover bugs is abysmal.
- fragmede 5y agoWhich definition of our? Seems like it was found just fine. It didn't get the attention it needed until after it was publicly disclosed, however. The distinction is that even with a magic 100% infallible bug finding service, if the fixes don't get the attention they need, even with this magic service is, the problem's still going to be around. (While this perfect infallible service doesn't actually exist, fuzzers do find bugs in a semi-automated fashion. Still, getting someone to pay attention to the reports is an uphill battle due to false positives.)
- yjftsjthsd-h 5y agoIt was found by a random third party; I think it's reasonable to say that "our" should include the people who are getting paid to ship the thing.
- mschuster91 5y ago> It was found by a random third party IIRC it was found and first exploited by Minecraft trolls. Lesson learned: the hardest opponent for any IT security team are online-game cheaters and trolls.
- andrewxdiamond 5y ago> Seems like it was found just fine. Sure, something like 8 years after it was put in place.