3 ms·

Can't tell what happened to the earlier link but I've fixed the it. Puck was being malicious in releasing the information. There's no favourable way of describ

by elorm 2y ago

Can't tell what happened to the earlier link but I've fixed the it. Puck was being malicious in releasing the information. There's no favourable way of describing disclosing a vulnerability on social media because the maintainers didn't meet your 7 day deadline. It's more of "we're forcing their hands since they haven't met our expectations yet" thing. There's so many ways they could've gotten a timely fix without "doing everyone a favour by not fully disclosing the entire 0 day." approach but like you said .... tough cookies all round. And to answer your final question, there's a patch available. https://github.com/NixOS/nixpkgs/pull/340885 https://github.com/NixOS/nixpkgs/pull/340885

NotEvil 2y ago
That's not a patch. It's just downgrades the nix version to 23 in nixpkgs. It doesn't help people who are already using the vulnerable version and also new users cuz installers install latest versions
grayhatter 2y ago
> Puck was being malicious in releasing the information. [citation needed] > There's no favourable way of describing disclosing a vulnerability on social media because the maintainers didn't meet your 7 day deadline. personally I'm grateful he didn't sit on a remote privexc vulnerability for 90days when he was confident it wasn't going to be fixed. I think you're conflating public disclosure (security though obscurity) with real harm, compromise due to the bug. If Puck found it, others who would gladly sell it for coin on the black market, would have found it.
3np 2y ago
Calling the reporter malicious is not constructive and does not help Nix (even if you are right). From all I can tell, there was no request to extend the deadline or proactively coordinating disclosure when the reporter pushed for it. That would have been preferred and could have avoided this situation. I would hope for a later postmortem incorporating the lesson of more proactive communication with reporters.
- soraminazuki 2y ago
  That the Nix team didn’t cooperate is a trivially disprovable excuse being pushed by people surrounding the fork. https://matrix.to/#/!VRULIdgoKmKPzJZzjj:nixos.org/$tJgEBGqKsyTUyCN9V_QvL21_rIt2zahFvw3KNujN8aI https://matrix.to/#/!VRULIdgoKmKPzJZzjj:nixos.org/$tJgEBGqKs...
  - 3np 2y ago
    Can we please stop this polarizing drama, from both sides? I never said that anyone wasn't cooperating. Quoting your link: > > is there any update on the root escalation vulnerability in 2.24? > Eelco is working on it, there's a patch on the GitHub advisory, we plan to get it out on Monday, but no promises yet if everything will get done by then This is what I mean is not sufficient in terms of disclosure coordination... Doesn't seem like anyone was necessarily acting in bad faith, just mutual frustration and room for improvement on professionalism on all sides. Though I'd hold NixOS maintainers to a higher expectation of professionalism than random independent security researchers. The important thing is that people draw the right lessons. "The X people suck" isn't a valuable lesson for any value of X. And if you're seeing bad intent on the reporter and them trying to prove a point; well yeah, maybe, and point proven? Processes should cover for these eventualities.
    - soraminazuki 2y ago
      The thing is, the reporter is not a random independent security researcher. She's a core team member of Lix, the fork, and is no stranger to the Nix community. This incident directly relates to the wider conflict between the two projects. That's why people are upset.
      - johnklos 2y ago
        So you're saying out loud that the person reporting the issue matters. It shouldn't matter who tells you that you have a security issue.
        2y ago

by elorm 2y ago

NotEvil 2y ago

That's not a patch. It's just downgrades the nix version to 23 in nixpkgs. It doesn't help people who are already using the vulnerable version and also new users cuz installers install latest versions

grayhatter 2y ago

> Puck was being malicious in releasing the information. [citation needed] > There's no favourable way of describing disclosing a vulnerability on social media because the maintainers didn't meet your 7 day deadline. personally I'm grateful he didn't sit on a remote privexc vulnerability for 90days when he was confident it wasn't going to be fixed. I think you're conflating public disclosure (security though obscurity) with real harm, compromise due to the bug. If Puck found it, others who would gladly sell it for coin on the black market, would have found it.

3np 2y ago

Calling the reporter malicious is not constructive and does not help Nix (even if you are right). From all I can tell, there was no request to extend the deadline or proactively coordinating disclosure when the reporter pushed for it. That would have been preferred and could have avoided this situation. I would hope for a later postmortem incorporating the lesson of more proactive communication with reporters.

soraminazuki 2y ago
That the Nix team didn’t cooperate is a trivially disprovable excuse being pushed by people surrounding the fork. https://matrix.to/#/!VRULIdgoKmKPzJZzjj:nixos.org/$tJgEBGqKsyTUyCN9V_QvL21_rIt2zahFvw3KNujN8aI https://matrix.to/#/!VRULIdgoKmKPzJZzjj:nixos.org/$tJgEBGqKs...
- 3np 2y ago
  Can we please stop this polarizing drama, from both sides? I never said that anyone wasn't cooperating. Quoting your link: > > is there any update on the root escalation vulnerability in 2.24? > Eelco is working on it, there's a patch on the GitHub advisory, we plan to get it out on Monday, but no promises yet if everything will get done by then This is what I mean is not sufficient in terms of disclosure coordination... Doesn't seem like anyone was necessarily acting in bad faith, just mutual frustration and room for improvement on professionalism on all sides. Though I'd hold NixOS maintainers to a higher expectation of professionalism than random independent security researchers. The important thing is that people draw the right lessons. "The X people suck" isn't a valuable lesson for any value of X. And if you're seeing bad intent on the reporter and them trying to prove a point; well yeah, maybe, and point proven? Processes should cover for these eventualities.
  - soraminazuki 2y ago
    The thing is, the reporter is not a random independent security researcher. She's a core team member of Lix, the fork, and is no stranger to the Nix community. This incident directly relates to the wider conflict between the two projects. That's why people are upset.
    - johnklos 2y ago
      So you're saying out loud that the person reporting the issue matters. It shouldn't matter who tells you that you have a security issue.
      - 2y ago