Conversation

Notices

pistolero :thispersondoesnotexist: (p@freespeechextremist.com)'s status on Monday, 18-Sep-2023 01:55:05 JST pistolero :thispersondoesnotexist:
- webb
@w

> This is fucking evil shit.

While you were sending angry DMs and refusing to answer "What the hell did I do that you're so pissed about?" and then stirring up a panic by also refusing to answer simple questions like "What is the impact of this, are all the admin tokens compromised?" I'd very much like not to have some stupid internet fight, so I held off until I saw this. But if you're insisting I'm evil (among other things in this thread), maybe I ought to say something.

The reason for a disclosure timeline is to give people time to apply a mitigation or patch. You give the vendor a chance to patch (that is, you and r, and to a lesser extent, me) and you give people time to apply the patches or do the mitigation. The point is to give notice to people that are affected and to give them a chance to avoid being impacted. It makes no sense to try to gag the stakeholders and panic users, so I just assumed that's not what we were doing. So I see your big announcement, people are asking me whether they need to stop using bloat, I just assume that you wouldn't be panicking people for no reason and I tell them the impact, and you start yelling at me over DMs. If the plan was "Just scare people and tell them to shut it all down because a bug exists and it might be tenuously called a security bug, but don't give them anything useful" then it should be completely understandable if I misread the plan, because no one would expect that plan.

There's already a patch. There's no reason to tell everyone to turn anything off, just send the patch to people that run public instances of bloat, tell them that you'll avoid discussing the bug in public for a couple of days. Unless you explain the impact and communicated the problem to people that were affected and able to do something about the problem, you've done more harm than good. No need for extra pageantry or two days' lead time because it doesn't actually help anyone. Last I heard, you were planning to wait an additional week anyway. If it's actually serious, you don't wait to make some small tweaks to the patch to make it configurable, you send out the patch.

Theatrics don't serve any purpose but to hype a couple of very minor bugs. I don't think I'm "evil" for letting people that use the software know about the impact (because that's what anyone would do) and crying wolf about security bugs is going to get you ignored if you actually find one; I think it's more evil to try to scare people without letting them know what's so scary.

> The issue is being downplayed now to a misleading/factually incorrect degree. DO NOT USE THE CLIENT.

Since I've seen the issue and am right now typing this message on bloat and have not felt the need to apply any patches to bloat, I can say that I am certain that the issue is not being downplayed but rather inflated. Theatrics don't serve any purpose but to hype a couple of very minor bugs. I don't think I'm "evil" for letting people that use the software know about the impact (because that's what anyone would do) and crying wolf about security bugs is going to get you ignored if you actually find one; I think it's more evil to try to scare people without letting them know what's so scary. Here: https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure
internetfight2.gif
In conversation about a year ago from freespeechextremist.com permalink
Attachments
1. internetfight2.gif
  https://freespeechextremist.com/media/2a0cac37-1190-47f4-9426-7eab00b71cab/internetfight2.gif?name=internetfight2.gif
2. Coordinated vulnerability disclosure
  
  In computer security, coordinated vulnerability disclosure (CVD, formerly known as responsible disclosure) is a vulnerability disclosure model in which a vulnerability or an issue is disclosed to the public only after the responsible parties have been allowed sufficient time to patch or remedy the vulnerability or issue. This coordination distinguishes the CVD model from the "full disclosure" model. Developers of hardware and software often require time and resources to repair their mistakes. Often, it is ethical hackers who find these vulnerabilities. Hackers and computer security scientists have the opinion that it is their social responsibility to make the public aware of vulnerabilities. Hiding problems could cause a feeling of false security. To avoid this, the involved parties coordinate and negotiate a reasonable period of time for repairing the vulnerability. Depending on the potential impact of the vulnerability, the expected time needed for an emergency fix or workaround to be developed and applied and other factors, this period may vary between a few days and several months. Coordinated vulnerability disclosure may fail to satisfy security...
- and † top dog :pedomustdie: like this.
- pistolero :thispersondoesnotexist: (p@freespeechextremist.com)'s status on Monday, 18-Sep-2023 21:43:47 JST pistolero :thispersondoesnotexist:
  in reply to
  - :btrfly: anime graf mays 🛰️🪐
  - webb
  @graf @w Yeah, I got notified, r got notified, consensus seemed to be that the bug is a bug but wasn't a big deal.
  
  If we're doing security LARP, no one expects that "responsible disclosure" processes gag the vendor or the users.
  
  In conversation about a year ago permalink
- (mint@ryona.agency)'s status on Monday, 18-Sep-2023 21:43:47 JST
  in reply to
  - :btrfly: anime graf mays 🛰️🪐
  - webb
  @p @w @graf What a fucking drama queen, holy fuck.
  https://archive.ph/CHhdY
  In conversation about a year ago permalink
  Attachments
  1. Untitled attachment
- :btrfly: anime graf mays 🛰️🪐 (graf@poa.st)'s status on Monday, 18-Sep-2023 21:43:48 JST :btrfly: anime graf mays 🛰️🪐
  in reply to
  - webb
  yeah you really shouldn't pen up a public post about something until all parties have been notified and a plan of action/fix is already in place
  
  In conversation about a year ago permalink
- pomstan (pomstan@xn--p1abe3d.xn--80asehdb)'s status on Monday, 18-Sep-2023 21:50:53 JST pomstan
  in reply to
  @mint @w @p @graf he even illustrated it lmao
  
  In conversation about a year ago permalink
  
  likes this.
- (mint@ryona.agency)'s status on Monday, 18-Sep-2023 21:51:51 JST
  in reply to
  @pomstan @w @p @graf Made the logo in best /g/ tradition.
  
  In conversation about a year ago permalink
- pomstan (pomstan@xn--p1abe3d.xn--80asehdb)'s status on Monday, 18-Sep-2023 21:55:27 JST pomstan
  in reply to
  @mint @graf @p @w
  On Unixy systems such as Linux there’s a little devil called the “OOM killer” (or here I’ll call him Oomy because that sounds cute.)
  имаджинируйте ебало автора
  
  In conversation about a year ago permalink
  
  likes this.
- Vivi Nella Verita :Debian_logo: (verita84@poster.place)'s status on Monday, 18-Sep-2023 21:59:09 JST Vivi Nella Verita :Debian_logo:
  in reply to
  @pomstan @w @p @graf @mint
  
  In conversation about a year ago permalink
  
  likes this.
- laurel (laurel@freespeechextremist.com)'s status on Monday, 18-Sep-2023 22:04:24 JST laurel
  in reply to
  @mint @p @graf @w
  
  >I created an eleven megabyte file that would fill those ten gigabytes in seconds.
  >The response body is limited to 8MB
  Pretty sure someone could do it with less than 8 megabytes, so I am FORCED to ANNOUNCE:
  
  This an EXPLOIT marked SEVERE
  Apply my patch now or your whole system will CRASH, you are putting your user's (digital) LIVES at RISK.
  
  tr := &http.Transport{
  DisableCompression: true,
  }
  client := &http.Client{Transport: tr}
  
  In conversation about a year ago permalink
  
  likes this.
- teknomunk (teknomunk@apogee.polaris-1.work)'s status on Monday, 18-Sep-2023 22:18:55 JST teknomunk
  in reply to
  @laurel @w @p @graf @mint
  
  So this is all over a decompression bomb vulnerability and not something actually serious like admin credentials being stolen?
  
  :talulah_tired:
  
  In conversation about a year ago permalink
  
  likes this.
- (mint@ryona.agency)'s status on Monday, 18-Sep-2023 22:21:07 JST
  in reply to
  @teknomunk @w @laurel @p @graf Yes, but there's a chance someone doesn't run earlyoom or something, so he just had to raise DEFCON 1 about it and omit all details.
  
  In conversation about a year ago permalink
- Exterminatus (ex@utih.net)'s status on Tuesday, 19-Sep-2023 00:20:25 JST Exterminatus
  in reply to
  @pomstan
  @w @p @graf @mint
  In conversation about a year ago permalink
  Attachments
  1. Untitled attachment
    https://storage.yandexcloud.net/pleroma/6977dc2a9c91dcba674df53321c1fbc4b074a3950395be7917dbc54972aa8479.png
  likes this.
- pistolero :thispersondoesnotexist: (p@freespeechextremist.com)'s status on Tuesday, 19-Sep-2023 00:27:45 JST pistolero :thispersondoesnotexist:
  in reply to
  @mint @graf @w Well, now that it's all disclosed, I can point to that and say that it's fucking stupid to say I was downplaying the issue. A malicious upstream server can make bloat exhaust its available memory: it's not a segfault, it's not remote execution, no exfiltration of tokens, no nop-sleds, nothing. bloat can't allocate more memory and falls over. That's it.
  
  In conversation about a year ago permalink
  
  likes this.
- pistolero :thispersondoesnotexist: (p@freespeechextremist.com)'s status on Tuesday, 19-Sep-2023 00:52:34 JST pistolero :thispersondoesnotexist:
  in reply to
  @mint @teknomunk @graf @laurel @w OOM score is going to be higher for something that has started allocating a ridiculous amount of memory out of nowhere and shows no signs of slowing down.
  
  I think it's best to run with a really low vm.overcommit_ratio to avoid OOM anyway. I never liked the optimistic allocator, it's like it's designed to cope with bad code.
  
  In conversation about a year ago permalink
  
  likes this.

Public

Conversation

Notices

Feeds