4 ms·

Not targeting the author as this appears not to be the case and he provided helpful advice, but it bugs me to no end how a not insignificant amount of people de

Not targeting the author as this appears not to be the case and he provided helpful advice, but it bugs me to no end how a not insignificant amount of people deals with security vulnerability and concerns. How casual, dismissive, aloof and many times straight up hostile and the most infantile ways they act when someone raises ( very valid ) concerns about security. I've seen this over and over again with Linux people, granted this view might be skewed because of the public reach of the project, but still.. they seem to view any communication regarding CVEs or security concerns or design recommendations as adversarial and tend go into the "I know more about Linux than you" and "Everything is fine until you convince me it's not, which will be never" mode. Not wanting to turn this into a dunking contest but, it's the general feeling I have about this.

amne 2y ago
It doesn't help that people rated a CVE 9.something for a PHP vuln in a barely used method of an extension that can be exploited if you use .. I forgot .. ah yes .. IIS. Peter says wolf too many times? Maybe a CVE should have a complex score (severity / spread): 9.9 / 4. severity 9.9 : easy to exploit if you run this .. you're cooked spread 4 : you most likely are not running this or it's by default in a way that you're not cooked
- yread 2y ago
  Indeed, CVSSs don't take into account how widespread the software is. You know it. Why are you surprised it got 9.9? It seems the cve shows how to completely pwn cups so it has a high one. I don't run pg but I'm not going to be moaning about the recent vulnerability in pgadmin being 9.9 "ugh why so high? I don't use it!"
TheDong 2y ago
> he provided helpful advice They use the 'they/them' pronouns. Do you run a large open source project or website that gets security contacts? The vast majority of security reports are poorly written and bogus, with the person either trying to get money or pad their resume with CVE. I think that contributes to developer's wariness of these things, and the "please prove that this is a real security issue" attitude you often see. May I reference: Beg bounties - https://news.sophos.com/en-us/2021/02/08/have-a-domain-name-beg-bounty-hunters-may-be-on-their-way/ https://news.sophos.com/en-us/2021/02/08/have-a-domain-name-... The bogus CVE problem - https://lwn.net/Articles/944209/ https://lwn.net/Articles/944209/
IshKebab 2y ago
Yeah it's because they identify with Linux and so if anyone points out a flaw in Linux it feels like pointing out a flaw in them. You often get the "you're holding it wrong" defence - in this case "obviously you shouldn't expose CUPS to the network!" despite the fact that that's clearly useful and should be how things work. There's an example in this thread: https://news.ycombinator.com/item?id=41668979 https://news.ycombinator.com/item?id=41668979
dathinab 2y ago
The context you are missing is that the person who had discovered this vulnerability has mad it up to be basically on the line of a easily doable RCE in every server you have (and every desktop Linux). Something which if you work in a position related to system administration can easily mean a bunch of unplanned overtime. Which is very very different to the IRL situation of "oh we are most most likely not affected but to be sure just disable printer discovery temporary". The post isn't meant to be dismissive of there being a vulnerability, it's dismissive of it being "so bad you can pawn all Linux systems ever", especially in context of servers. And if I had to guess it partially exist so that if people (as in people doing sysadmin stuff) consult here she can point them to the blog post instead of repeating herself over and over. Through in general I agree that there are parts of the Linux community which do not handle security concerns well at all. But also there is a trend of people which do not understand what they are talking about and refuse to learn or people which just want a ton of attention blowing up security issues out of proportion again and again. And that is bad kinda like the story of the child who yelling wolf except it's like 50 adults yelling wolf. It also can lead to all kind of other personal annoyances like you having to unnecessarily doing overtime and wasting time with having people to tell again and again "yes we are fine, this doesn't affect us, actually this doesn't affect most server setups. Yes they said otherwise, yes they knowingly misrepresented facts when they announced that there will be a vulnerability beforehand, no they never had a good reputation but we have to take them serious anyway, etc. etc.". So I have quite a bit of understanding for some people in the field being sometimes quite annoyed (not for all of them tho). (Also to I think you might be reading a bit too much into here blog post and my comments above where meant to be "in general" not specific to the blog post.)

amne 2y ago

It doesn't help that people rated a CVE 9.something for a PHP vuln in a barely used method of an extension that can be exploited if you use .. I forgot .. ah yes .. IIS. Peter says wolf too many times? Maybe a CVE should have a complex score (severity / spread): 9.9 / 4. severity 9.9 : easy to exploit if you run this .. you're cooked spread 4 : you most likely are not running this or it's by default in a way that you're not cooked

yread 2y ago
Indeed, CVSSs don't take into account how widespread the software is. You know it. Why are you surprised it got 9.9? It seems the cve shows how to completely pwn cups so it has a high one. I don't run pg but I'm not going to be moaning about the recent vulnerability in pgadmin being 9.9 "ugh why so high? I don't use it!"

TheDong 2y ago

> he provided helpful advice They use the 'they/them' pronouns. Do you run a large open source project or website that gets security contacts? The vast majority of security reports are poorly written and bogus, with the person either trying to get money or pad their resume with CVE. I think that contributes to developer's wariness of these things, and the "please prove that this is a real security issue" attitude you often see. May I reference: Beg bounties - https://news.sophos.com/en-us/2021/02/08/have-a-domain-name-beg-bounty-hunters-may-be-on-their-way/ https://news.sophos.com/en-us/2021/02/08/have-a-domain-name-... The bogus CVE problem - https://lwn.net/Articles/944209/ https://lwn.net/Articles/944209/

IshKebab 2y ago

Yeah it's because they identify with Linux and so if anyone points out a flaw in Linux it feels like pointing out a flaw in them. You often get the "you're holding it wrong" defence - in this case "obviously you shouldn't expose CUPS to the network!" despite the fact that that's clearly useful and should be how things work. There's an example in this thread: https://news.ycombinator.com/item?id=41668979 https://news.ycombinator.com/item?id=41668979

dathinab 2y ago

The context you are missing is that the person who had discovered this vulnerability has mad it up to be basically on the line of a easily doable RCE in every server you have (and every desktop Linux). Something which if you work in a position related to system administration can easily mean a bunch of unplanned overtime. Which is very very different to the IRL situation of "oh we are most most likely not affected but to be sure just disable printer discovery temporary". The post isn't meant to be dismissive of there being a vulnerability, it's dismissive of it being "so bad you can pawn all Linux systems ever", especially in context of servers. And if I had to guess it partially exist so that if people (as in people doing sysadmin stuff) consult here she can point them to the blog post instead of repeating herself over and over. Through in general I agree that there are parts of the Linux community which do not handle security concerns well at all. But also there is a trend of people which do not understand what they are talking about and refuse to learn or people which just want a ton of attention blowing up security issues out of proportion again and again. And that is bad kinda like the story of the child who yelling wolf except it's like 50 adults yelling wolf. It also can lead to all kind of other personal annoyances like you having to unnecessarily doing overtime and wasting time with having people to tell again and again "yes we are fine, this doesn't affect us, actually this doesn't affect most server setups. Yes they said otherwise, yes they knowingly misrepresented facts when they announced that there will be a vulnerability beforehand, no they never had a good reputation but we have to take them serious anyway, etc. etc.". So I have quite a bit of understanding for some people in the field being sometimes quite annoyed (not for all of them tho). (Also to I think you might be reading a bit too much into here blog post and my comments above where meant to be "in general" not specific to the blog post.)