3 ms·

For the impatient, here's the fix: https://github.com/golang/go/commit/f7cc61e7d7f77521e073137c6045ba73f66ef902 https://github.com/golang/go/commit/f7cc61e7d7f7

For the impatient, here's the fix: https://github.com/golang/go/commit/f7cc61e7d7f77521e073137c6045ba73f66ef902 https://github.com/golang/go/commit/f7cc61e7d7f77521e073137c...

cmckn 1y ago
I noticed this when reviewing the linked issue: https://github.com/golang/go/issues/73259#issuecomment-3100443997 https://github.com/golang/go/issues/73259#issuecomment-31004... Does the Go team have a natural language bot or is this just comment.contains(“backport”) type stuff?
- kbolino 1y ago
  The latter: https://github.com/golang/build/blob/master/cmd/gopherbot/gopherbot.go https://github.com/golang/build/blob/master/cmd/gopherbot/go... (found via https://go.dev/wiki/gopherbot https://go.dev/wiki/gopherbot)
  - 9rx 1y ago
    Although also the former (gabyhelp): https://github.com/golang/oscar/tree/master/internal/gaby https://github.com/golang/oscar/tree/master/internal/gaby
  - etra0 1y ago
    Kinda funny that it requires both "please" and "backport" for it to be considered haha.
chavi2 1y ago
One thing I worry about, probably unnecessarily, is anything with a sense of urgency. HEY GUYS WE JUST FOUND A GOLANG COMPILER BUG AND FATAL PANICS! Everyone is like “Hmm. I need to fix this now.” So, 99% probability it’s what it is. 1% it’s some secret defensive thing because there was a bad stupid zero day someone would get fired over or that could leave the world in shambles if uncovered, or maybe something else needed to be swept under the rug, or maybe someone wants to distract while they introduce a new vulnerability. I don’t think this with CVEs, but when someone’s like “install this patch everybody!” the dim red light flickers on.
- jimsmart 1y ago
  It's an open source project — and quite a popular one, at that — and you are literally replying to a comment that specifies the changes made to fix this particular issue — you can see for yourself what is occurring here. Anyone can. This issue, and the fix, has perfectly good visibility. Even if you personally can't understand the code, plenty of others can and do. All of which makes your claims seem like quite unnecessary paranoia — to a lot of folk... and I suspect that is probably why your comment is getting heavily downvoted.
  - pengaru 1y ago
    the account was created 22 hours ago, it's pointless to engage

For the impatient, here's the fix: https://github.com/golang/go/commit/f7cc61e7d7f77521e073137c6045ba73f66ef902 https://github.com/golang/go/commit/f7cc61e7d7f77521e073137c...

cmckn 1y ago

I noticed this when reviewing the linked issue: https://github.com/golang/go/issues/73259#issuecomment-3100443997 https://github.com/golang/go/issues/73259#issuecomment-31004... Does the Go team have a natural language bot or is this just comment.contains(“backport”) type stuff?

kbolino 1y ago
The latter: https://github.com/golang/build/blob/master/cmd/gopherbot/gopherbot.go https://github.com/golang/build/blob/master/cmd/gopherbot/go... (found via https://go.dev/wiki/gopherbot https://go.dev/wiki/gopherbot)
- 9rx 1y ago
  Although also the former (gabyhelp): https://github.com/golang/oscar/tree/master/internal/gaby https://github.com/golang/oscar/tree/master/internal/gaby
- etra0 1y ago
  Kinda funny that it requires both "please" and "backport" for it to be considered haha.

chavi2 1y ago

One thing I worry about, probably unnecessarily, is anything with a sense of urgency. HEY GUYS WE JUST FOUND A GOLANG COMPILER BUG AND FATAL PANICS! Everyone is like “Hmm. I need to fix this now.” So, 99% probability it’s what it is. 1% it’s some secret defensive thing because there was a bad stupid zero day someone would get fired over or that could leave the world in shambles if uncovered, or maybe something else needed to be swept under the rug, or maybe someone wants to distract while they introduce a new vulnerability. I don’t think this with CVEs, but when someone’s like “install this patch everybody!” the dim red light flickers on.

jimsmart 1y ago
It's an open source project — and quite a popular one, at that — and you are literally replying to a comment that specifies the changes made to fix this particular issue — you can see for yourself what is occurring here. Anyone can. This issue, and the fix, has perfectly good visibility. Even if you personally can't understand the code, plenty of others can and do. All of which makes your claims seem like quite unnecessary paranoia — to a lot of folk... and I suspect that is probably why your comment is getting heavily downvoted.
- pengaru 1y ago
  the account was created 22 hours ago, it's pointless to engage