3 ms·
But these CVEs were filed anonymously. Wouldn't that make it hard to take credit for it? At least in a verifiable way?
by thayne 3y ago
But these CVEs were filed anonymously. Wouldn't that make it hard to take credit for it? At least in a verifiable way?
- rwmj 3y agoIsn't this the person who filed it? https://www.postgresql.org/message-id/CAA8ZSMqAHDCgo07hqKoM5XJaoQy6Vv76O7966agez4ffyQktkA%40mail.gmail.com https://www.postgresql.org/message-id/CAA8ZSMqAHDCgo07hqKoM5... But even "anonymous" CVEs have this problem since in some teams you can get raises/bonuses based on the number of CVEs you report. See the other reply here: https://news.ycombinator.com/item?id=37406345 https://news.ycombinator.com/item?id=37406345
- owenmarshall 3y agoNot necessarily: that email reported a legitimate bug and identifies a buffer overflow. They don't mention anything about it being exploitable or try to work towards this. Then the CVE was published >20 days later. It's very possible someone else watching the Postgres DL saw an email with "buffer overflow" and pushed it out.
- dylan604 3y agoFlipped the other way, prove that the person taking credit didn't file it.