4 ms·

If you read the links: they discovered that using this flag broke EVERY installation of FRR on the internet. They let the developers know. And then said they

by tw04 3y ago

If you read the links: they discovered that using this flag broke EVERY installation of FRR on the internet. They let the developers know. And then said they were going to test again in a week. Does any sane person think that 1 week is enough time to both notify every user of FRR in the WORLD, as well as ensure they have upgraded their installations for a "bug" that only is triggered by someone using experimental flags meant for testing purposes only? Mind you, these researchers didn't test ANYTHING in a lab environment first "because it's a lot of work to test all the open source BGP implementations in the wild". AKA: I'm lazy.

LegionMammal978 3y ago
> Mind you, these researchers didn't test ANYTHING in a lab environment first "because it's a lot of work to test all the open source BGP implementations in the wild". AKA: I'm lazy. That's a gross exaggeration: they said that they first tried it "in a controlled environment with different versions of Cisco, BIRD, and Quagga routers" [0] without issue. Presumably, the problem we know about would have been avoided if they had happened to include FRR in their test suite beforehand. But that raises the next question, exactly how many implementations does one need to test before one is no longer "lazy"? [0] https://mailman.nanog.org/pipermail/nanog/2019-January/098765.html https://mailman.nanog.org/pipermail/nanog/2019-January/09876...