4 ms·
So you're saying out loud that the person reporting the issue matters. It shouldn't matter who tells you that you have a security issue.
by johnklos 2y ago
So you're saying out loud that the person reporting the issue matters. It shouldn't matter who tells you that you have a security issue.
- soraminazuki 2y agoNobody ever said it isn't okay to report security issues. This is about dumping 0 days on social media when you know fully well that the other side is cooperating and working on a fix. The who in this case matters because the reporter knew how the Nix community works, knew it was hostile thing to do, and did it anyways. Again, https://matrix.to/#/!VRULIdgoKmKPzJZzjj:nixos.org/$tJgEBGqKsyTUyCN9V_QvL21_rIt2zahFvw3KNujN8aI https://matrix.to/#/!VRULIdgoKmKPzJZzjj:nixos.org/$tJgEBGqKs... What I meant is crystal clear if you read what I was replying to. Please don't take it out of context to spin a story. You did it in your original comment, and you did it again right here.
- johnklos 2y agoNo, I'm really not trying to take things out of context, but what you wrote really makes it seem like the person who reports it matters. Ignoring that, I agree that it's a dick move, but it's like our famous "well, technically" memes - the delivery might matter, but in the case of security issues, it really doesn't matter as much as the actual content. "You have an issue, and I'm going to be a dick and release it in a week." Yes, that would be a dick move, but someone acting like a dick doesn't mean that the Nix team shouldn't address the issue within that week, even if it does feel like extortion. Also, those matrix links say nothing. I'm not sure what we're supposed to do with them, but I'm not downloading software to see whatever it is you want to share.