4 ms·

- No CVE. - Distributions weren't contacted prior the release. - Everyone can see the diff for the fix in the codebase. - There are a PoC as test-case in the

by xs_kid 13y ago

- No CVE. - Distributions weren't contacted prior the release. - Everyone can see the diff for the fix in the codebase. - There are a PoC as test-case in the code. - The release was done in the start of weekend when everyone in America is leaving the office and everyone in Europe is sleeping. - A big part of the community is in two conferences right now. IMHO that was the worst way to provide a security update.

rmrfrmrf 13y ago
Boohoo; 1 or 2 Hubots and Ghost blogs might crash over the weekend. If you're as paranoid as you seem to be, you have someone on call to fix this and wouldn't have dared to have put such an untested technology out in the wild.
ehsanu1 13y ago
While the security update protocol leaves something to be desired, the possibility of a DoS attach is not quite as bad as a vulnerability that leaks real information. If that were to happen, I'd hope all the steps you've outlined would be followed.
- tux1968 13y ago
  Agreed, however it would be nice to test and reinforce those steps at a time like this when they're not as crucially important.
glenjamin 13y ago
The initial report was made publicly, including a proof of concept exploit, and is currently viewable via google cache. The censored issue report is referenced with a metasploit pull request containing code that can be used to exploit. Given this, I'd say sooner is better than later. It would be prudent to mention making your load balancer limit the number of requests than can be pipelined down a single connection should resolve any issue.
- xs_kid 13y ago
  The metasploit exploit was possible only thanks to the release (see the tweets of metasploit maintainer @hdmoore), IMO they could have waited until Monday morning to release it.
microb 13y ago
What conferences?
- xs_kid 13y ago
  JSConfCo: http://jsconf.co/ http://jsconf.co/ RealtimeConf: http://2013.realtimeconf.com/ http://2013.realtimeconf.com/

by xs_kid 13y ago

rmrfrmrf 13y ago

Boohoo; 1 or 2 Hubots and Ghost blogs might crash over the weekend. If you're as paranoid as you seem to be, you have someone on call to fix this and wouldn't have dared to have put such an untested technology out in the wild.

ehsanu1 13y ago

While the security update protocol leaves something to be desired, the possibility of a DoS attach is not quite as bad as a vulnerability that leaks real information. If that were to happen, I'd hope all the steps you've outlined would be followed.

tux1968 13y ago
Agreed, however it would be nice to test and reinforce those steps at a time like this when they're not as crucially important.

glenjamin 13y ago

The initial report was made publicly, including a proof of concept exploit, and is currently viewable via google cache. The censored issue report is referenced with a metasploit pull request containing code that can be used to exploit. Given this, I'd say sooner is better than later. It would be prudent to mention making your load balancer limit the number of requests than can be pipelined down a single connection should resolve any issue.

xs_kid 13y ago
The metasploit exploit was possible only thanks to the release (see the tweets of metasploit maintainer @hdmoore), IMO they could have waited until Monday morning to release it.

microb 13y ago

What conferences?

xs_kid 13y ago
JSConfCo: http://jsconf.co/ http://jsconf.co/ RealtimeConf: http://2013.realtimeconf.com/ http://2013.realtimeconf.com/