3 ms·

I'm a bit confused about the timeline at the bottom, was the vulnerability patched?

by remram 3y ago

Mathnerd314 3y ago
It looks like they never replied to him for months so he just published it. This would also fit with the HN title (conclusion in the post). I think if it was patched it would be "I found a bug".
- SV_BubbleTime 3y ago
  This sounds like Rigol and Siglent. Very impressive hardware for the price, questionable support and software.
  - nimish 3y ago
    Siglent seems to be moving upmarket at least. Rigol has wildly good on paper hardware but their software is suspect. Rigol made their own ADC chip that beats most off the shelf stuff yet they have some of the jankiest software and English translation known to man.
- pmontra 3y ago
  From the timeline > RIGOL says they would reply in 2-3 days, 1/28/23 > Full disclosure, 2/8/23 Those should be January 28 2023 and February 8 2023, which is the date of the post. It's only 13 days after the last communication from RIGOL, not months. By the way, could at least us developers use ISO dates instead of whatever our local conventions are?
  - mlyle 3y ago
    > It's only 13 days after the last communication from RIGOL, not months. 3 months of total stalling without a real reply to him. The last communication was only that they'd provide more details in a few days. The fact that he asked again before the disclosure timeframe and they were like "uh, just give us a minute" doesn't change anything.
  - starlevel003 3y ago
    > By the way, could at least us developers use ISO dates instead of whatever our local conventions are? 2023-28 and 2023-39 aren't any more readable.
    - ooterness 3y ago
      Usually when people say ISO8601, they mean "2023-07-12T09:20:00Z". But the actual spec, which no one reads because it costs money to access, allows dozens of other variations. (Too many IMHO.) RFC3339 is compatible with "the good parts" of ISO8601 and it's also free. https://www.rfc-editor.org/rfc/rfc3339 https://www.rfc-editor.org/rfc/rfc3339
      - mulmen 3y ago
        I interpret "ISO 8601" to be "lexicographically sortable in chronological order" or maybe "big endian".
  - jacquesm 3y ago
    I prefer to use dd/mmm/yyyy with mmm like jan/feb/mar etc that takes care of all confusion and seems to be understood the world over. This saves me from having to adopt some local convention depending on who I'm invoicing.
    - mschuster91 3y ago
      Problem is you can't sort in that order.
      - jacquesm 3y ago
        I don't think anybody reading my invoices will have trouble interpreting them, and if they need to sort then they're welcome to add their own version of the date. But at least there will be no ambiguity about when I sent the invoice.
  - kriive 3y ago
    Yeah, I agree that 13 days from the last contact was maybe a bit too fast. But they haven't replied to this day and I reported the vuln two months earlier without response! P.S. sorry for the american time dates, I don't know what I was thinking lol.

I'm a bit confused about the timeline at the bottom, was the vulnerability patched?

by remram 3y ago

I'm a bit confused about the timeline at the bottom, was the vulnerability patched?

It looks like they never replied to him for months so he just published it. This would also fit with the HN title (conclusion in the post). I think if it was patched it would be "I found a bug".

SV_BubbleTime 3y ago
This sounds like Rigol and Siglent. Very impressive hardware for the price, questionable support and software.
- nimish 3y ago
  Siglent seems to be moving upmarket at least. Rigol has wildly good on paper hardware but their software is suspect. Rigol made their own ADC chip that beats most off the shelf stuff yet they have some of the jankiest software and English translation known to man.
pmontra 3y ago
From the timeline > RIGOL says they would reply in 2-3 days, 1/28/23 > Full disclosure, 2/8/23 Those should be January 28 2023 and February 8 2023, which is the date of the post. It's only 13 days after the last communication from RIGOL, not months. By the way, could at least us developers use ISO dates instead of whatever our local conventions are?
- mlyle 3y ago
  > It's only 13 days after the last communication from RIGOL, not months. 3 months of total stalling without a real reply to him. The last communication was only that they'd provide more details in a few days. The fact that he asked again before the disclosure timeframe and they were like "uh, just give us a minute" doesn't change anything.
- starlevel003 3y ago
  > By the way, could at least us developers use ISO dates instead of whatever our local conventions are? 2023-28 and 2023-39 aren't any more readable.
  - ooterness 3y ago
    Usually when people say ISO8601, they mean "2023-07-12T09:20:00Z". But the actual spec, which no one reads because it costs money to access, allows dozens of other variations. (Too many IMHO.) RFC3339 is compatible with "the good parts" of ISO8601 and it's also free. https://www.rfc-editor.org/rfc/rfc3339 https://www.rfc-editor.org/rfc/rfc3339
    - mulmen 3y ago
      I interpret "ISO 8601" to be "lexicographically sortable in chronological order" or maybe "big endian".
- jacquesm 3y ago
  I prefer to use dd/mmm/yyyy with mmm like jan/feb/mar etc that takes care of all confusion and seems to be understood the world over. This saves me from having to adopt some local convention depending on who I'm invoicing.
  - mschuster91 3y ago
    Problem is you can't sort in that order.
    - jacquesm 3y ago
      I don't think anybody reading my invoices will have trouble interpreting them, and if they need to sort then they're welcome to add their own version of the date. But at least there will be no ambiguity about when I sent the invoice.
- kriive 3y ago
  Yeah, I agree that 13 days from the last contact was maybe a bit too fast. But they haven't replied to this day and I reported the vuln two months earlier without response! P.S. sorry for the american time dates, I don't know what I was thinking lol.