4 ms·
I don't have a substantive comment to offer, but good on Simon Tatham for the clear and forthcoming write-up. No damage-control lawyerly BS, no 'ego', just the
by MaxBarraclough 3y ago
I don't have a substantive comment to offer, but good on Simon Tatham for the clear and forthcoming write-up. No damage-control lawyerly BS, no 'ego', just the facts about the issue.
It's reassuring to see a solid disclosure after a security issue, and we too often see half-truths and deceptive downplaying, e.g. LastPass.
- loop22 3y ago> No damage-control lawyerly BS, no 'ego' And no cutesy name for the vulnerability
- xwolfi 3y agoThe "Dragon Eater Vulnerability", that all managers will agitate about mitigating for the next 4 weeks...
- d-z-m 3y agoSillyPutty
- SV_BubbleTime 3y agoCanon now.
- rustcleaner 3y agoSeconded.
- Sohcahtoa82 3y agoI think named vulnerabilities are useful when it's a "STOP THE WORLD" kind of vulnerability like Heartbleed and Shellshock. It's much easier to talk about Heartbleed than "CVE-2014-0160". The problem, IMO, is when medium-severity vulnerabilities are given names, like Terrapin. I think it makes people think a vulnerability is much worse than it really is.
- itsTyrion 3y agoHeartbleed was a decade ago? JFC I’m getting old
- pertymcpert 3y agoYes, Simon is a brilliant person (hi Simon!) and would be the last person on earth to do any spin. He also doesn't owe anyone anything, PuTTY was a gift from him to the world when there was no good alternative on Windows, a gift that has had an incalculably large benefit to so many people that no one should forget.
- hashtag-til 3y agoI had the pleasure to meet him in person and the guy is just so grounded and nice to interact and help you with stuff in a non-judgmental way. Many people I know, with less than 1% of his contributions to OSS, have inflated egos and are just full of themselves, so it is refreshing to have people such as Simon in the OSS community.