2 ms·

There's no obligation for a hobbyist to fix the stuff they publish online. If they're selling the result, then sure, you can argue there's reasonable considerat

There's no obligation for a hobbyist to fix the stuff they publish online. If they're selling the result, then sure, you can argue there's reasonable consideration, but just because a security researcher has made a contribution (and a valuable one) it doesn't compel any further contribution from the original author. Now, the lack of action does probably remove some of the credibility of the project as one that should be used in any security context (bit of a problem for something intended to be used as authentication).

some_furry 2y ago
> There's no obligation for a hobbyist to fix the stuff they publish online. Correct, but I didn't say there was. The onus being on them to fix it is predicated on anyone having such an obligation at all. If anyone has an obligation, it's always the vendor, not the researcher. But keep in mind this situation involves an IBM-funded open source project under the Red Hat product line. The hobbyist remark is tangential to the story.
prmoustache 2y ago
> There's no obligation for a hobbyist to fix the stuff they publish online. I may be wrong but this might not the case anymore in 2025 (not sure about the timeline) in the European Union because of the new cybersecurity acts.
- some_furry 2y ago
  I don't have a business presence in the EU, so I rarely care about that for my own projects. (Insofar as I do care, it's limited to "let's not make GDPR compliance logically impossible when designing cryptographic features").
- rcxdude 2y ago
  There's carve-outs in that for open source hobbyists ("not associated with commercial activity"). This was originally vaguely worded but they've now made it a lot less ambiguous, the only open source it covers is that which is being developed by a company which is also making money directly from it. (And in the case that a company takes that code and uses it in a product, they are responsible to fix any security vulnerabilities but also to report it to the author)

some_furry 2y ago

> There's no obligation for a hobbyist to fix the stuff they publish online. Correct, but I didn't say there was. The onus being on them to fix it is predicated on anyone having such an obligation at all. If anyone has an obligation, it's always the vendor, not the researcher. But keep in mind this situation involves an IBM-funded open source project under the Red Hat product line. The hobbyist remark is tangential to the story.

prmoustache 2y ago

> There's no obligation for a hobbyist to fix the stuff they publish online. I may be wrong but this might not the case anymore in 2025 (not sure about the timeline) in the European Union because of the new cybersecurity acts.

some_furry 2y ago
I don't have a business presence in the EU, so I rarely care about that for my own projects. (Insofar as I do care, it's limited to "let's not make GDPR compliance logically impossible when designing cryptographic features").
rcxdude 2y ago
There's carve-outs in that for open source hobbyists ("not associated with commercial activity"). This was originally vaguely worded but they've now made it a lot less ambiguous, the only open source it covers is that which is being developed by a company which is also making money directly from it. (And in the case that a company takes that code and uses it in a product, they are responsible to fix any security vulnerabilities but also to report it to the author)