3 ms·

The latest commit from the user who committed those patches is weirdly a simplification of the security reporting process, to not request as much detail: https

The latest commit from the user who committed those patches is weirdly a simplification of the security reporting process, to not request as much detail: https://github.com/tukaani-project/xz/commit/af071ef7702debef4f1d324616a0137a5001c14c https://github.com/tukaani-project/xz/commit/af071ef7702debe... Not sure what to make of this.

caelum19 3y ago
Potentially the purpose is that if someone goes to the effort to get those details together, they are more likely to send the same report to other trusted individuals. Maybe it was originally there to add legitimacy, then they got a report sent in, and removed it to slow the spread of awareness
- londons_explore 3y ago
  > Affected versions of XZ Utils Most people, to find the affected versions, would either have to bisect or delve deep enough to find the offending commit. Either of which would reveal the attacker. By not asking for the version, there is a good chance you just report "It's acting oddly, plz investigate".
rany_ 3y ago
I think the reason is pretty obvious. They want you to waste more time after you've submitted the security report and maximize the amount of back and forth. Basically the hope is that they'd be able to pester you with requests for more info/details in order to "resolve the issue" which would give them more time to exploit their targets.
colanderman 3y ago
That repository is now disabled. But here's a similar change to the .github repository of tukaani-project from @JiaT75 to the bug report template: + or create a private Security Advisory instead. Under a commit titled "Wrap text on Issue template .yaml files." [1] https://github.com/tukaani-project/.github/commit/44b766adc413b7b7ccfa2bfdd89d2540e88739ca https://github.com/tukaani-project/.github/commit/44b766adc4...

3 ms·

The latest commit from the user who committed those patches is weirdly a simplification of the security reporting process, to not request as much detail: https

by colanderman 3y ago

caelum19 3y ago
Potentially the purpose is that if someone goes to the effort to get those details together, they are more likely to send the same report to other trusted individuals. Maybe it was originally there to add legitimacy, then they got a report sent in, and removed it to slow the spread of awareness
- londons_explore 3y ago
  > Affected versions of XZ Utils Most people, to find the affected versions, would either have to bisect or delve deep enough to find the offending commit. Either of which would reveal the attacker. By not asking for the version, there is a good chance you just report "It's acting oddly, plz investigate".
rany_ 3y ago
I think the reason is pretty obvious. They want you to waste more time after you've submitted the security report and maximize the amount of back and forth. Basically the hope is that they'd be able to pester you with requests for more info/details in order to "resolve the issue" which would give them more time to exploit their targets.
colanderman 3y ago
That repository is now disabled. But here's a similar change to the .github repository of tukaani-project from @JiaT75 to the bug report template: + or create a private Security Advisory instead. Under a commit titled "Wrap text on Issue template .yaml files." [1] https://github.com/tukaani-project/.github/commit/44b766adc413b7b7ccfa2bfdd89d2540e88739ca https://github.com/tukaani-project/.github/commit/44b766adc4...