4 ms·
This screams NDA/disclosure but things are so mega super fucked that they feel obligated to pre warn as early as possible. I wonder how long/old the problem is
by jofzar 2y ago
This screams NDA/disclosure but things are so mega super fucked that they feel obligated to pre warn as early as possible.
I wonder how long/old the problem is in atop?
- czk 2y agoSeems like the latest version might be as old as July 2024? https://www.atoptool.nl/allnews.php https://www.atoptool.nl/allnews.php For anyone interested, here are the latest commits to the GitHub: https://github.com/Atoptool/atop/commits/master/ https://github.com/Atoptool/atop/commits/master/
- jofzar 2y agoI have this weird gut feeling that it's going to be one of those "this was introduced in 2010 commit and has been in every build since" Edit: I have no knowledge of what this is FYI.
- DominoTree 2y agoSkimming through the code (particularly from past issues and PRs) highlights a number of things that look sketchy to me at first glance (in a coding practices way, not in a malicious way) - my gut feeling is that someone smarter than me going through much of this with a fine-toothed-comb would likely find something exploitable. Rewrite it in Rust. /s
- benterix 2y ago> my gut feeling is that someone smarter than me going through much of this with a fine-toothed-comb Seems that's already started: https://github.com/Atoptool/atop/issues/330 https://github.com/Atoptool/atop/issues/330
- plorkyeran 2y agoYeah, from a rando this would be just bad vagueposting but Rachel is absolutely someone who could know about a very good reason why we should uninstall atop but be unable to legally say why. I would heed her warning.
- bigstrat2003 2y agoI would disagree and still say that this is bad vagueposting. It doesn't matter how reputable the source is: if you say "don't do X" but don't give a reason why, I'm not inclined to listen. Granted I don't use atop anyways, but I don't think a vague blog post - even one from a respected person - is sufficient justification to change what software one uses.
- mandmandam 2y ago> It doesn't matter how reputable the source is: It does though. "Don't go down 6th street now" means very different things depending on whether it comes from your buddy, or the bomb squad. > if you say "don't do X" but don't give a reason why, I'm not inclined to listen. I hear ya, but, there are sometimes valid reasons people can't say things; and this may well be one of those times. You have every right to do as you like, but it's not necessarily smart now that you've been warned by a respected professional.
- Wistar 2y ago“Boys, keep off the moors. Stick to the roads, and the best of luck.”
- kaonwarb 2y agoBayes would like to have a word.
- sulam 2y agoThis attitude will eventually burn you.
- mjevans 2y agoThat last line for sure reads as '(author) can't tell you now, but can (plans to) tell you later'; NDA and/or CVE as most likely reasons.
- refulgentis 2y agoPresumably one step removed? I assume vague-posting would be an NDA violation, though now I'm second-guessing that...
- imoreno 2y agoWhy would there be an NDA on atop? It's under GPL.
- lolinder 2y agoIt might be covered under an NDA with some company that she's contracting with if she/they discovered the vulnerability in the course of their work.
- devmor 2y agoIt could also be any number of other things too, like it's severe enough that the author feels its responsible to wait for mitigation efforts before disclosing anything about the issue that could lead to it being exploited.
- YetAnotherNick 2y ago"screams NDA" is not the same as "might be covered under an NDA". And in any case, very likely the said company has already taken mitigative action like removing atop already.
- rybosome 2y agoAgreed. Severe CVE seems like the ticket here given the context.