3 ms·

I think current way is better This way admins and ppl can prepare. If you release fix and cve at the same time then race between bad actors and ppl starts

rowanG077 3y ago
And now the race has started with admins not being able to do anything. Anyone that knows of this vulnerability has enough time for a last hurray to exploit it as much as possible.
- Palmik 3y ago
  To anyone that knows what the vulnerability is, this announcement does not bring any new information.
  - rowanG077 3y ago
    It most definitely does. You know it's going to be patched. You no longer have to tiptoe around to conceal the problem. This can be the difference between snooping a bit of data here and there and just straight up dumping the contents of entire servers. Of course this depends on the vulnerability itself. But knowing a vulnerability will be patched can be hugely interesting and worthwhile information
    - tsimionescu 3y ago
      Except of course they don't know what vulnerability is getting patched. So, they might actually end up revealing a different vulnerability.
      - rowanG077 3y ago
        Of course. It's a risk that could easily be worth it depending on the actor and vulnerability
  - tsimionescu 3y ago
    I suppose it's theoretically possible someone was hoarding this as a zero-day and may decide to more actively exploit it before it gets patched. Except of course that they don't know which precise vulnerability it is.
    - Ekaros 3y ago
      Also what I consider is that who has insider access and how does that information leak... This fix must be known at least some members of curl developers. Will they leak it or not? Or anyone who receive it early...
- bayindirh 3y ago
  I don't agree. As an admin I can cordon off systems which might be exploited until the fix is released. If there's nothing to exploit, how can you exploit it?
  - rowanG077 3y ago
    Sure you can. Do you think slack can? Google can just down their entire fleet? Servers are an essential part of the world functioning. Curl is such a foundational library it's almost sure to be used in a large of part of existing servers.

rowanG077 3y ago

And now the race has started with admins not being able to do anything. Anyone that knows of this vulnerability has enough time for a last hurray to exploit it as much as possible.

Palmik 3y ago
To anyone that knows what the vulnerability is, this announcement does not bring any new information.
- rowanG077 3y ago
  It most definitely does. You know it's going to be patched. You no longer have to tiptoe around to conceal the problem. This can be the difference between snooping a bit of data here and there and just straight up dumping the contents of entire servers. Of course this depends on the vulnerability itself. But knowing a vulnerability will be patched can be hugely interesting and worthwhile information
  - tsimionescu 3y ago
    Except of course they don't know what vulnerability is getting patched. So, they might actually end up revealing a different vulnerability.
    - rowanG077 3y ago
      Of course. It's a risk that could easily be worth it depending on the actor and vulnerability
- tsimionescu 3y ago
  I suppose it's theoretically possible someone was hoarding this as a zero-day and may decide to more actively exploit it before it gets patched. Except of course that they don't know which precise vulnerability it is.
  - Ekaros 3y ago
    Also what I consider is that who has insider access and how does that information leak... This fix must be known at least some members of curl developers. Will they leak it or not? Or anyone who receive it early...
bayindirh 3y ago
I don't agree. As an admin I can cordon off systems which might be exploited until the fix is released. If there's nothing to exploit, how can you exploit it?
- rowanG077 3y ago
  Sure you can. Do you think slack can? Google can just down their entire fleet? Servers are an essential part of the world functioning. Curl is such a foundational library it's almost sure to be used in a large of part of existing servers.