4 ms·

Here is a response from the VideoLAN president: http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia http://www.jbkempf.com/blog/post/2013/More-lies-fr

by afreak 13y ago

Here is a response from the VideoLAN president: http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia

kevingadd 13y ago
VideoLAN doesn't come out of this looking particularly mature or professional. A lotta buck-passing...
- brigade 13y ago
  Of what to whom? VLC fixed the vulnerability themselves, and upstreamed the fix themselves. They do complain that Secunia didn't inform or issue an advisory on upstream projects - if VLC had not taken the initiative themselves to upstream the fix then all other apps would still be vulnerable.
- dvt 13y ago
  Actually, Secunia comes out of this looking clueless. It has never been the responsibility of application developers to fix vulnerabilities in third-party libraries (like, ever). But they did anyway -- keep in mind that this is an open source initiative, not some large company with code monkeys ready to rumble. Furthermore, Secunia doesn't seem to realize that VLC doesn't do static linking on all platforms (lol) -- I mean, why even go after VLC? This was clearly an ffmpeg problem. What a bunch of amateurs.
  - tzs 13y ago
    > It has never been the responsibility of application developers to fix vulnerabilities in third-party libraries (like, ever) If your customer gets it from you, then it is your responsibility.
    - Cederfjard 13y ago
      What customers though? Edit: To clarify, from what I can tell no one has ever paid even a cent for VLC, though they may have donated to the VideoLAN project. And regardless of whether you feel that they had any moral responsibility to fix the vulnerability anyway, it's hard to fault VideoLAN here since that is exactly what they did (unless you believe Secunia's side of the story, of course).
    - dvt 13y ago
      Actually, it's not, but you might have the responsibility to inform your customers. Consider closed-source libraries. Like I said, the status quo has always been to delegate third-party vulnerabilities or bugs (especially if statically linked) to their respective vendors. The people from VLC were gentlemen for fixing the problem themselves and then upstreaming. I doubt many would disagree.
      - tptacek 13y ago
        It depends. Vendors are obligated to handle upstream vulnerabilities once they become known, and commercial vendors are obligated to handle upstream vulnerabilities no matter what. The only situation in which a vendor can wash their hands of a vulnerability is the one in which they're informed of an upstream vulnerability and the upstream isn't, at which point that vendor is at least obligated to relay it to the upstream.
    - jezfromfuture 13y ago
      Dont be stupid. these get uplined like anythign else.
  - Tobu 13y ago
    Secunia does seem selectively clueless (I think of it more as fear-mongering, what with the Twitter posturing and stealth edits of their reports), but AFAIK their vulnerability index exists to be linked from their "software inspector" products which scan binary Windows releases, which do tend to include bundled libraries. However, their blog post makes no mention of that, and they don't seem to question the link between vulnerability PR and actual, verifiable vulnerabilities.
deleted 13y ago
[deleted]
tptacek 13y ago
I'd be careful about rushing to judgement on this. I'd rate both sources as equally credible and the issue here is pretty complex. Both parties have commercial incentives.
- hugoroy 13y ago
  VideoLan is a non for profit association, and VLC is Free Software (GPL). I wouldn't qualify their incentives as being the same (and VideoLan has no commercial incentive at all by definition).
  - tptacek 13y ago
    I defer to you on this and apologize if I've mischaracterized VLC.
- Cederfjard 13y ago
  What commercial incentives do VideoLAN have? From what I've gathered, they are a non-profit funded by donations that are solely used for maintaining the project (i.e. there are no paid employees and so on). Though I may have misunderstood.
  - jbk 13y ago
    No you are perfectly right. VideoLAN members and VLC developers are volunteers.

by afreak 13y ago

Here is a response from the VideoLAN president: http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia http://www.jbkempf.com/blog/post/2013/More-lies-from-Secunia

kevingadd 13y ago

VideoLAN doesn't come out of this looking particularly mature or professional. A lotta buck-passing...

brigade 13y ago
Of what to whom? VLC fixed the vulnerability themselves, and upstreamed the fix themselves. They do complain that Secunia didn't inform or issue an advisory on upstream projects - if VLC had not taken the initiative themselves to upstream the fix then all other apps would still be vulnerable.
dvt 13y ago
Actually, Secunia comes out of this looking clueless. It has never been the responsibility of application developers to fix vulnerabilities in third-party libraries (like, ever). But they did anyway -- keep in mind that this is an open source initiative, not some large company with code monkeys ready to rumble. Furthermore, Secunia doesn't seem to realize that VLC doesn't do static linking on all platforms (lol) -- I mean, why even go after VLC? This was clearly an ffmpeg problem. What a bunch of amateurs.
- tzs 13y ago
  > It has never been the responsibility of application developers to fix vulnerabilities in third-party libraries (like, ever) If your customer gets it from you, then it is your responsibility.
  - Cederfjard 13y ago
    What customers though? Edit: To clarify, from what I can tell no one has ever paid even a cent for VLC, though they may have donated to the VideoLAN project. And regardless of whether you feel that they had any moral responsibility to fix the vulnerability anyway, it's hard to fault VideoLAN here since that is exactly what they did (unless you believe Secunia's side of the story, of course).
  - dvt 13y ago
    Actually, it's not, but you might have the responsibility to inform your customers. Consider closed-source libraries. Like I said, the status quo has always been to delegate third-party vulnerabilities or bugs (especially if statically linked) to their respective vendors. The people from VLC were gentlemen for fixing the problem themselves and then upstreaming. I doubt many would disagree.
    - tptacek 13y ago
      It depends. Vendors are obligated to handle upstream vulnerabilities once they become known, and commercial vendors are obligated to handle upstream vulnerabilities no matter what. The only situation in which a vendor can wash their hands of a vulnerability is the one in which they're informed of an upstream vulnerability and the upstream isn't, at which point that vendor is at least obligated to relay it to the upstream.
  - jezfromfuture 13y ago
    Dont be stupid. these get uplined like anythign else.
- Tobu 13y ago
  Secunia does seem selectively clueless (I think of it more as fear-mongering, what with the Twitter posturing and stealth edits of their reports), but AFAIK their vulnerability index exists to be linked from their "software inspector" products which scan binary Windows releases, which do tend to include bundled libraries. However, their blog post makes no mention of that, and they don't seem to question the link between vulnerability PR and actual, verifiable vulnerabilities.

deleted 13y ago

[deleted]

tptacek 13y ago

I'd be careful about rushing to judgement on this. I'd rate both sources as equally credible and the issue here is pretty complex. Both parties have commercial incentives.

hugoroy 13y ago
VideoLan is a non for profit association, and VLC is Free Software (GPL). I wouldn't qualify their incentives as being the same (and VideoLan has no commercial incentive at all by definition).
- tptacek 13y ago
  I defer to you on this and apologize if I've mischaracterized VLC.
Cederfjard 13y ago
What commercial incentives do VideoLAN have? From what I've gathered, they are a non-profit funded by donations that are solely used for maintaining the project (i.e. there are no paid employees and so on). Though I may have misunderstood.
- jbk 13y ago
  No you are perfectly right. VideoLAN members and VLC developers are volunteers.