4 ms·

Hey guys so I work on a tool call Bismuth along with my co-founder for finding and fixing bugs and we think we have this. At the very least we have a bug in ato

Hey guys so I work on a tool call Bismuth along with my co-founder for finding and fixing bugs and we think we have this. At the very least we have a bug in atop which mimics what is being described. We're going to throw this sha down right here: 1d53b12f3bc325dcfaff51a89011f01bffca951db9df363e6b5d6233f23248a5 And now we're going to go responsibly disclose what we have to the maintainers.

ianbutler 2y ago
We've reached out to the maintainer over e-mail.
Retr0id 2y ago
Based on the bug you've found, do you think it's exploitable beyond DoS?
__turbobrew__ 2y ago
Thank you for doing this instead of just vagueposting and wasting everyone’s time.
- vanderZwan 2y ago
  I'm inclined to expect that we should put the blame for that on whomever used legal channels to force Rachel to shut up, although obviously the jury is still out until we know more.
  - supriyo-biswas 2y ago
    This is the only explanation that makes some sense, otherwise it would be just a dick move for someone to hint at the presence of an exploitable bug but then not say what exactly it is.
    - immibis 2y ago
      Not telling you how to hack a whole bunch of computers until the bug is fixed is called responsible disclosure. It's very popular, and depending on how the government is feeling that day, may be illegal not to do.
  - spyc 2y ago
    I'm reading "I can go into why another time." like "I don't have time" personally, not like "I am not allowed to say".
    - vanderZwan 2y ago
      Then you are overlooking two things that provide important context: her previous behavior in similar circumstances of discovering bugs, and the opening sentence: > My life as a mercenary sysadmin can be interesting. To me this reads as "I was hired as a consutant for something that required a very restrictive NDA."
  - stavros 2y ago
    It might have just been responsible disclosure.
    - __turbobrew__ 2y ago
      In that case: report the bug, keep your mouth shut until the bug is fixed, then talk about the bug once it is fixed or your responsible disclosure deadline has passed. Turned out the bug was a 2.9 CVE nothingburger. It’s not like they found the FSB/Mossad/NSA had hooks in a remotely exploitable root level process.
spyc 2y ago
Hi! Three things: - There is no commit with a SHA1 like that in atop Git history and what you shared is too long for a SHA1, it looks more like a SHA256. Did you share the right checksum? The only other way I can read this is that it's a SHA256 checksum of one of the past atop release tarballs or artifacts. I have not yet checked those. - I have tried finding your tool Bismuth but all I find is things KDE and crypto currencies. Please share a link to the Bismuth that you are working on. - You technically said that you are working on Bismuth /and/ found something, not that you found the bug /through/ Bismuth. Please clarify if and how that was the case. Thank you!
- throwawayben 2y ago
  pretty sure it's just a hash of some text they can reveal later, to prove that they had something at this point in time. not referring to any release or commit
  - spyc 2y ago
    I see, thanks!
  - ianbutler 2y ago
    This is exactly correct
- spyc 2y ago
  Update: I found https://www.bismuth.sh/ https://www.bismuth.sh/ at https://news.ycombinator.com/user?id=ianbutler https://news.ycombinator.com/user?id=ianbutler .
- ianbutler 2y ago
  - That SHA is just a proof marker so if it turns out we are correct we can prove we had it at that time - Bismuth did indeed find the bug, our bug scanning feature in particular. Obviously we're going to sit on our hands until the maintainer gives the all clear but we'll write something up after this is all squared away - https://www.bismuth.sh https://www.bismuth.sh is our tool, we're still relatively new
ianbutler 2y ago
We did in fact find the bug: https://news.ycombinator.com/item?id=43519522 https://news.ycombinator.com/item?id=43519522

ianbutler 2y ago

We've reached out to the maintainer over e-mail.

Retr0id 2y ago

Based on the bug you've found, do you think it's exploitable beyond DoS?

__turbobrew__ 2y ago

Thank you for doing this instead of just vagueposting and wasting everyone’s time.

vanderZwan 2y ago
I'm inclined to expect that we should put the blame for that on whomever used legal channels to force Rachel to shut up, although obviously the jury is still out until we know more.
- supriyo-biswas 2y ago
  This is the only explanation that makes some sense, otherwise it would be just a dick move for someone to hint at the presence of an exploitable bug but then not say what exactly it is.
  - immibis 2y ago
    Not telling you how to hack a whole bunch of computers until the bug is fixed is called responsible disclosure. It's very popular, and depending on how the government is feeling that day, may be illegal not to do.
- spyc 2y ago
  I'm reading "I can go into why another time." like "I don't have time" personally, not like "I am not allowed to say".
  - vanderZwan 2y ago
    Then you are overlooking two things that provide important context: her previous behavior in similar circumstances of discovering bugs, and the opening sentence: > My life as a mercenary sysadmin can be interesting. To me this reads as "I was hired as a consutant for something that required a very restrictive NDA."
- stavros 2y ago
  It might have just been responsible disclosure.
  - __turbobrew__ 2y ago
    In that case: report the bug, keep your mouth shut until the bug is fixed, then talk about the bug once it is fixed or your responsible disclosure deadline has passed. Turned out the bug was a 2.9 CVE nothingburger. It’s not like they found the FSB/Mossad/NSA had hooks in a remotely exploitable root level process.

spyc 2y ago

Hi! Three things: - There is no commit with a SHA1 like that in atop Git history and what you shared is too long for a SHA1, it looks more like a SHA256. Did you share the right checksum? The only other way I can read this is that it's a SHA256 checksum of one of the past atop release tarballs or artifacts. I have not yet checked those. - I have tried finding your tool Bismuth but all I find is things KDE and crypto currencies. Please share a link to the Bismuth that you are working on. - You technically said that you are working on Bismuth /and/ found something, not that you found the bug /through/ Bismuth. Please clarify if and how that was the case. Thank you!

throwawayben 2y ago
pretty sure it's just a hash of some text they can reveal later, to prove that they had something at this point in time. not referring to any release or commit
- spyc 2y ago
  I see, thanks!
- ianbutler 2y ago
  This is exactly correct
spyc 2y ago
Update: I found https://www.bismuth.sh/ https://www.bismuth.sh/ at https://news.ycombinator.com/user?id=ianbutler https://news.ycombinator.com/user?id=ianbutler .
ianbutler 2y ago
- That SHA is just a proof marker so if it turns out we are correct we can prove we had it at that time - Bismuth did indeed find the bug, our bug scanning feature in particular. Obviously we're going to sit on our hands until the maintainer gives the all clear but we'll write something up after this is all squared away - https://www.bismuth.sh https://www.bismuth.sh is our tool, we're still relatively new

ianbutler 2y ago

We did in fact find the bug: https://news.ycombinator.com/item?id=43519522 https://news.ycombinator.com/item?id=43519522