4 ms·

This is basically useless without identifying the vulnerability.

by rascul 4y ago

detaro 4y ago
It's not useless, and if it identified the vulnerability it'd massively increase the risk of it being used before patch release.
- rascul 4y ago
  It's useless because I don't know if I need to care. Vulnerabilities in openssl are nothing new so as far as I know this is just par for the course, and I get nothing out of it as of yet.
  - detaro 4y ago
    ... and an announcement like this is a fairly strong message of "assume you need to care"
    - deleted 4y ago
      [deleted]
    - rascul 4y ago
      I'm not going to assume anything in regards to a future release I have no details about.
      - deleted 4y ago
        [deleted]
      - iamtedd 4y ago
        So what do you propose is the alternative? Not tell you about the vulnerability at all until a patch is released? Publish all the details about the vulnerability before a patch is available? Seriously, what are you complaining about?
        rascul 4y ago
        I just want actionable information is all. If I have to wait a couple days, fine. Giving me vague information I can't do anything with is useless.
        iamtedd 4y ago
        > I just want actionable information Which is, according to TFA, being released on 1 Nov., and according to my calendar, is in 3 days... Problem solved?
        rascul 4y ago
        I'm not yet convinced there's a problem.
        iamtedd 4y ago
        You're not convinced? About a security vulnerability... From an open-source project... That has a history of major security vulnerabilities... Because there's no detailed information yet... When industry best practice is to not give detailed information without a patch or workaround... And they're giving you a heads-up for required mitigation in three days... Rather than right now...
        rascul 4y ago
        No, I'm not convinced that the vulnerability is something I need to care about, because there's no details about it. I can make that determination when I have details. I am well aware of that project's history. I see no information given that would imply this to be anything more special than a regular update for me, for which the process I have already streamlined. I understand the practice of not giving the details until there's a patch and I'm OK with that, but there's now been over 10 submissions to HN about it with over 150 combined comments and all we know is that an update is coming. I'm not buying into the hype.
      - apstls 4y ago
        The detail that it patches a critical vulnerability should be enough for you to assume you should care, assuming you care about security.
- insanitybit 4y ago
  Attackers can just go look at the repo's commits. Holding back the information only hurts defenders.
  - macintux 4y ago
    It seems unlikely to me that the maintainers are that careless.
    - insanitybit 4y ago
      It is the norm for the patch to be committed and the CVE to be acquired as part of that process.
      - macintux 4y ago
        Yep, per this comment my optimism was misplaced. https://news.ycombinator.com/item?id=33384596 https://news.ycombinator.com/item?id=33384596
        macintux 4y ago
        Or, it appears I may have been correct the first time. https://news.ycombinator.com/item?id=33382684 https://news.ycombinator.com/item?id=33382684
        insanitybit 4y ago
        That's cool. Some projects do that, some do not.
macintux 4y ago
You left out the key phrase "to me". Clearly some people prefer to know in advance, to make sure they're prepared to patch critical servers on that day, and perhaps even take some offline until then.

This is basically useless without identifying the vulnerability.

by rascul 4y ago

This is basically useless without identifying the vulnerability.

It's not useless, and if it identified the vulnerability it'd massively increase the risk of it being used before patch release.

rascul 4y ago
It's useless because I don't know if I need to care. Vulnerabilities in openssl are nothing new so as far as I know this is just par for the course, and I get nothing out of it as of yet.
- detaro 4y ago
  ... and an announcement like this is a fairly strong message of "assume you need to care"
  - deleted 4y ago
    [deleted]
  - rascul 4y ago
    I'm not going to assume anything in regards to a future release I have no details about.
    - deleted 4y ago
      [deleted]
    - iamtedd 4y ago
      So what do you propose is the alternative? Not tell you about the vulnerability at all until a patch is released? Publish all the details about the vulnerability before a patch is available? Seriously, what are you complaining about?
      - rascul 4y ago
        I just want actionable information is all. If I have to wait a couple days, fine. Giving me vague information I can't do anything with is useless.
        iamtedd 4y ago
        > I just want actionable information Which is, according to TFA, being released on 1 Nov., and according to my calendar, is in 3 days... Problem solved?
        rascul 4y ago
        I'm not yet convinced there's a problem.
        iamtedd 4y ago
        You're not convinced? About a security vulnerability... From an open-source project... That has a history of major security vulnerabilities... Because there's no detailed information yet... When industry best practice is to not give detailed information without a patch or workaround... And they're giving you a heads-up for required mitigation in three days... Rather than right now...
        rascul 4y ago
        No, I'm not convinced that the vulnerability is something I need to care about, because there's no details about it. I can make that determination when I have details. I am well aware of that project's history. I see no information given that would imply this to be anything more special than a regular update for me, for which the process I have already streamlined. I understand the practice of not giving the details until there's a patch and I'm OK with that, but there's now been over 10 submissions to HN about it with over 150 combined comments and all we know is that an update is coming. I'm not buying into the hype.
    - apstls 4y ago
      The detail that it patches a critical vulnerability should be enough for you to assume you should care, assuming you care about security.
insanitybit 4y ago
Attackers can just go look at the repo's commits. Holding back the information only hurts defenders.
- macintux 4y ago
  It seems unlikely to me that the maintainers are that careless.
  - insanitybit 4y ago
    It is the norm for the patch to be committed and the CVE to be acquired as part of that process.
    - macintux 4y ago
      Yep, per this comment my optimism was misplaced. https://news.ycombinator.com/item?id=33384596 https://news.ycombinator.com/item?id=33384596
      - macintux 4y ago
        Or, it appears I may have been correct the first time. https://news.ycombinator.com/item?id=33382684 https://news.ycombinator.com/item?id=33382684
        insanitybit 4y ago
        That's cool. Some projects do that, some do not.

macintux 4y ago

You left out the key phrase "to me". Clearly some people prefer to know in advance, to make sure they're prepared to patch critical servers on that day, and perhaps even take some offline until then.