4 ms·

16. Sep. 2014 - Notified the Drupal devs via security contact form 15. Okt. 2014 - Relase of Bugfix by Drupal core Developers I know it's open source v

by btucker 12y ago

16. Sep. 2014 - Notified the Drupal devs via security contact form 15. Okt. 2014 - Relase of Bugfix by Drupal core Developers I know it's open source volunteers & all, but that seems like a rather slow reaction to such a critical vulnerability with a simple fix, doesn't it?

thejosh 12y ago
Drupalcon happened during this time.
- ceejayoz 12y ago
  I really don't think that is a valid excuse for taking a month to make a one-line critical security patch.
  - thejosh 12y ago
    Absolutely, and also considering that the window is once a week (I believe), this should have happened ASAP.
    - chx 12y ago
      https://www.drupal.org/documentation/version-info#when https://www.drupal.org/documentation/version-info#when once a month rather.
  - outlandish-josh 12y ago
    The vulnerability has been there for four years. It's critical, but not widely exploited. As soon as you release an update, the exploits will be found and weaponized. It's 24 hours later and we're already clocking scripted attacks. Coordinating a flawless release by a) not doing it during a major distraction event (DrupalCon) and b) allowing an embargo period for people within the security community to prepare is MUCH more important than rushing out the fix a few weeks earlier. The response here is indicative of the professionalism of the Drupal security group IMHO.
    - chx 12y ago
      Six years. It was committed in 2008 december.
scolson 12y ago
Was it a simple fix? Certainly an elegant one. Excluding Drupalcon, I'd imagine it took some amount of time to determine the scope of the problem (was this the only avenue?), best method of resolution (there might have been a few ways to patch this that were more complicated before settling on this one), and then testing to make sure additional problems were not introduced on possible fixes. This was a pretty critical part of Drupal core, so it would be irresponsible to rush out a patch without proper testing and analysis. Could it have been done quicker? Maybe. But I don't think this is a completely unreasonable period of time.

by btucker 12y ago

thejosh 12y ago

Drupalcon happened during this time.

ceejayoz 12y ago
I really don't think that is a valid excuse for taking a month to make a one-line critical security patch.
- thejosh 12y ago
  Absolutely, and also considering that the window is once a week (I believe), this should have happened ASAP.
  - chx 12y ago
    https://www.drupal.org/documentation/version-info#when https://www.drupal.org/documentation/version-info#when once a month rather.
- outlandish-josh 12y ago
  The vulnerability has been there for four years. It's critical, but not widely exploited. As soon as you release an update, the exploits will be found and weaponized. It's 24 hours later and we're already clocking scripted attacks. Coordinating a flawless release by a) not doing it during a major distraction event (DrupalCon) and b) allowing an embargo period for people within the security community to prepare is MUCH more important than rushing out the fix a few weeks earlier. The response here is indicative of the professionalism of the Drupal security group IMHO.
  - chx 12y ago
    Six years. It was committed in 2008 december.

scolson 12y ago

Was it a simple fix? Certainly an elegant one. Excluding Drupalcon, I'd imagine it took some amount of time to determine the scope of the problem (was this the only avenue?), best method of resolution (there might have been a few ways to patch this that were more complicated before settling on this one), and then testing to make sure additional problems were not introduced on possible fixes. This was a pretty critical part of Drupal core, so it would be irresponsible to rush out a patch without proper testing and analysis. Could it have been done quicker? Maybe. But I don't think this is a completely unreasonable period of time.